Reporting a security issue

If you have found a security issue in CompleteFTP, edtFTPj, edtFTPnet, or our website, we would like to hear from you and we will work with you to resolve it.

How to reach us

Raise a request through our support portal using the Report a security vulnerability form. Give us the issue and the affected product and version. If you have a proof of concept, attach it to the request rather than pasting it into the description (that keeps it out of email notifications). The request is sent over HTTPS and is visible only to our support team and you.

This contact is also listed in our security.txt.

What helps

  • The product and version affected.
  • The steps to reproduce, and a proof of concept if you have one.
  • The impact as you see it, and a CVSS vector if you use one.
  • Any disclosure timeline you have in mind.

What to expect from us

  • We will acknowledge your report.
  • We will keep you updated as we assess and fix it.
  • We ask that you give us a reasonable chance to release a fix before any public write-up or CVE, and we will agree a timing with you.
  • If you would like credit when we publish, tell us the name or handle to use.

Good-faith research

We welcome good-faith security research. When you look into an issue, please test against your own installation rather than our production systems, do not access or change data that is not yours, avoid anything that disrupts our services or other users, and give us a reasonable chance to fix the issue before you publish.

Other technical articles

Download Free Trial