Security
Vulnerability disclosure policy
Anthony Timbers LLC welcomes reports of security vulnerabilities in our software and website from security researchers, customers and partners. If you believe you’ve found one, please tell us. We’ll work with you to understand and fix it.
How to report
Email [email protected] with:
- a description of the vulnerability and its potential impact;
- the product and version affected (in Continu-US, the version is shown under Administration → Updates);
- steps to reproduce it, and any proof-of-concept code or screenshots;
- how you’d like to be credited, if at all.
Please don’t include personal data or data belonging to anyone else in your report.
What we commit to
- Acknowledge your report within 3 business days.
- Confirm whether we can reproduce it, and tell you our plan, within 10 business days.
- Fix confirmed vulnerabilities as signed security releases, with these targets from confirmation:
| Severity | Fix target |
|---|---|
| Critical | 7 days |
| High | 30 days |
| Medium | 90 days |
| Low | next scheduled release |
- Keep you informed until the issue is resolved.
- Credit you in the release notes once a fix is available, if you’d like.
Scope
In scope:
- Continu-US: the Azure managed application, its function apps, the dashboard and Administration console, and the endpoint check scripts and agents;
- anthonytimbers.com.
Out of scope:
- customers’ own Azure tenants, devices and data. Test only an installation you own or are authorized to test;
- denial-of-service or load testing;
- social engineering, phishing or physical attacks;
- vulnerabilities in third-party services we rely on, such as Microsoft Azure or Entra ID. Please report those to the vendor;
- reports from automated scanners with no demonstrated impact.
Good-faith research
When you research under this policy, please:
- test only systems you own or are authorized to test;
- access or keep only the data you need to demonstrate the issue, and delete it afterward;
- stop testing and tell us right away if you reach sensitive data;
- avoid harming systems, data or other users;
- give us reasonable time to fix the issue before disclosing it publicly. We suggest 90 days, or sooner once we’ve shipped a fix.
If you follow this policy, we consider your research authorized and made in good faith. We won’t pursue or support legal action against you for it. If a third party brings legal action over research you did under this policy, we’ll make it known that your work was authorized.
Recognition
We don’t offer a paid bug bounty at this time. We’re glad to credit researchers whose reports lead to a fix.
Our software security practices
Every Continu-US release passes automated testing, static code analysis, dependency vulnerability checks, secrets scanning and an independent code review. Releases are signed, and each ships with a software bill of materials (SBOM). Customers receive security fixes through Continu-US’s signed update process.
Last updated: October 16, 2026