Product security
Security advisories
Every vulnerability we fix in Regulaxy is published here — with no account, no form, and no waiting for a renewal.
Why this is public
We sell patch coordination to regulated institutions. A vendor who hides its own vulnerabilities behind a login is asking its customers for exactly what it will not do itself. The people who need this page most — a customer's SOC, their external auditor, the analyst shortlisting us — hold no portal account.
What each level means
- Critical
- Remote exploitation without authentication, or full compromise of the Regulaxy server. Schedule an immediate patch window.
- High
- Privilege escalation, access-control bypass, or exposure of sensitive data to an authenticated user. Schedule in the next window.
- Medium
- Conditional exploitation — needs high privilege, local access, or a non-default configuration. Fold into the normal patch cycle.
- Low
- Limited impact, or a weakness that must be chained with another to matter. No operational urgency.
How we publish
- When
- An advisory is published with the fixed build, never before it. A customer inside an air gap cannot download a fix within the hour, and early publication only opens an attack window without giving them anything to do about it.
- Embargo
- Where a vulnerability is coordinated with an external reporter or another vendor, the advisory is held until the coordination date. We give no advance notice to one customer ahead of the others — selective advance notice is precisely what makes a coordination date meaningless.
- Revising an advisory
- Every material change gets a revision number and a changelog line, and the previous revisions stay on the page. A security document with silent edits is not evidence.
- Withdrawal
- An advisory published in error is marked withdrawn and never deleted. A customer's SOC has already ingested it from the feed, and a document that silently disappears is worse than one marked withdrawn.
- Severity rating
- We rate on four levels and publish a CVSS vector beside it where we have one. Our rating is the operational decision; CVSS is a figure anyone can re-derive. Where the two disagree, the words are what counts.
- Reporting a vulnerability
- Found one in Regulaxy? We have a disclosure procedure, and it needs no account. Vulnerability disclosure
Machine-readable output
All of it served without authentication and without rate limiting, so a vulnerability-management tool can pull it directly.
- Atom feed
- Every published advisory, newest first. Updated on publication.
/security/advisories/atom.xml- provider-metadata.json
- The standard entry point for a CSAF publisher. Everything else is reachable from it.
/.well-known/csaf/provider-metadata.json- changes.csv
- What changed and when, newest first. Enough to pull only what is new.
/api/csaf/changes.csv- CSAF 2.0
- One JSON document per advisory, to the OASIS standard. This is what a SOC's tooling reads.
/api/csaf/demo-advisory-0001.json- Air-gap bundle
- One file carrying every CSAF document with a SHA-256 digest for each. Download on the connected side, carry it in on media, ingest it inside.
/api/csaf/bundle.json