01 How to report
Email legal@arcnode.dev with the subject “Security disclosure”. We read reports in English and Dutch. Please include:
- which component is affected (see section 2), with versions where you know them;
- what the vulnerability is and what an attacker could achieve with it;
- step-by-step instructions or a proof of concept that reproduces it;
- whether you have shared it with anyone else; and
- how you would like to be credited, if at all.
Do not put working exploits or other people’s data in public issue trackers, chats or social media. If you need to send something sensitive, say so in a first email and we will agree a way to exchange it.
02 Scope
These components are in scope:
| Component | What is included |
|---|---|
| Arcnode Remote desktop app | The latest released version for Windows: the encrypted session protocol, Verification Codes and Device Keys, consent and permission checks, privacy mode, any-time access and its trust file, file transfer, sign-in and token storage, the updater and its signature check, and Support Links. |
| Arcnode Remote relay | The relay service and its TLS listener at relay.remote.arcnode.dev, the plaintext listener while it is still served, and the website and Support Link pages at remote.arcnode.dev. |
| Arcnode Remote on Backboard | The Arcnode Remote endpoints of backboard.arcnode.dev: helper access, operator attestations, relay tokens, the computers list, relay-id rotation, update checks and downloads, and sign-in with Arcnode as used by the app. |
| Other Arcnode services | Reports about arcnode.dev, backboard.arcnode.dev and other services operated by Arcnode Network are welcome too, and are handled under this policy, including its safe harbour. |
Examples of what interests us most: connecting to a computer without the person’s approval, getting more access than the person granted, reading or changing session content, impersonating a verified helper, bypassing helper access, reaching a computer through any-time access without being its trusted helper, guessing session codes faster than the limits allow, and installing an update that Arcnode did not sign.
03 Out of scope
- Attacks that need malware already running as the same Windows user, physical access to an unlocked computer, or administrator rights on it, unless they break a protection we claim to give in that situation.
- Social engineering of people, including convincing someone to allow a session; phishing of our staff or users.
- Denial-of-service and load tests, spam, and brute-forcing codes against the production relay.
- Known limitations that we describe ourselves, such as the relay’s plaintext first line in app versions without TLS, the missing Authenticode signature on the installer, and that privacy mode cannot stop a separate screen recorder, unless you find a way to make them worse than described.
- Missing security headers or cookie flags without a demonstrated impact, clickjacking on pages without sensitive actions, version disclosure, and reports from automated scanners without a working proof.
- Vulnerabilities in third-party services or libraries that we cannot fix ourselves; report those to their owners (tell us if they affect us).
- Features that are announced but not yet released.
04 Rules for testing
- Only test against accounts, computers and sessions that you own or have explicit permission to use. Use two computers of your own to test sessions.
- Never access, change, delete or keep data that is not yours. If you reach other people’s data by accident, stop, don’t keep or share it, and tell us.
- Do not degrade the service for others: no denial of service, no mass connection or code attempts against the production relay. Ask us if you need a test setup.
- Do no more than needed to show the vulnerability. No backdoors, no persistence, no pivoting to other systems.
- Give us a reasonable time to fix the problem before you disclose it: we ask for 90 days from your report, or less once a fix is released, and we will agree a date with you.
- Do not ask for payment in exchange for not disclosing.
05 Safe harbour
If you act in good faith and follow this policy, Arcnode Network will not take legal action against you or report you to the police for your research, and we will consider it authorized under the Terms of Use and the Acceptable Use Policy, including the restrictions on reverse engineering and security testing in the Arcnode Remote Terms of Service.
If someone else takes legal action against you for research done under this policy, we will make clear that you acted with our authorization. We cannot authorize testing of systems we don’t own, such as our hosting providers. This safe harbour does not apply to anyone who breaks the rules in section 4, or who uses a vulnerability to harm people.
06 What happens after you report
| Step | Our target |
|---|---|
| We confirm we received your report | Within 3 working days. |
| We give a first assessment (valid or not, severity, next steps) | Within 10 working days. |
| We fix the problem | As soon as we can. Our aim is 30 days for critical and high severity issues and 90 days for others. We keep you informed at least every 30 days. |
| We release the fix and tell you | App fixes reach users through the signed updater; server fixes are deployed directly. |
| We agree on disclosure | After the fix is available, we publish what happened where it matters to users, and credit you if you want. |
If a vulnerability is being actively exploited, we may act faster and tell users earlier. If it involves a personal data breach, we handle it under our Privacy Policy.
07 Recognition
We do not run a paid bug bounty at this time. With your permission, we thank you by name (or an alias) in the release notes of the fix.
08 Scams and misuse are not vulnerabilities
Someone used Arcnode Remote against you?
If a scammer got access to your computer, disconnect, turn off any-time access in the tray or Settings, and report it as described in the Acceptable Use Policy. Arcnode, Microsoft and banks never call you to offer help with your computer.
09 security.txt and contact
This policy is referenced from arcnode.dev/.well-known/security.txt and remote.arcnode.dev/.well-known/security.txt (RFC 9116).
Arcnode Network, Netherlands
legal@arcnode.dev