Disclosure window
90 days
Security
Posture, disclosure, trust.
The Northken security posture. Disclosure process, trust practices, what is public and what is not, how to report.
PGP available
Yes
Bug bounty
Selective
Public audits
Annual
Trust center.
Disclosure process
Coordinated disclosure with documented window. PGP available. The process is described in security.txt at /.well-known/security.txt.
Observable practices
OWASP Top 10, dependency tracking, change review, environment isolation. Each practice is documented in /standards.
Audits and reviews
Annual external audit, internal review at each major release. Public summaries on /standards.
What is not public
Specific attack surfaces, internal architecture details, customer-specific configurations. These are protected by default.
How to report.
For a vulnerability report, write to [email protected] with PGP if possible. Include a clear description, a reproducible scenario, and the potential impact. We acknowledge within 24 hours, coordinate the timeline, and credit the reporter (unless they prefer anonymity).
What we commit to.
No legal action against good-faith research. Coordinated disclosure within the documented window. Public credit if desired. No request for silence under threat. The trust chain is observable, not just promised.
Report a vulnerability.
[email protected] — PGP available. The disclosure window is documented. We acknowledge within 24 hours.
[email protected]