Skip to main content

Vulnerability Disclosure Policy

Sequent Tech welcomes reports from security researchers, consumers, election auditors, and the general public. The security of the Sequent Voting Platform, including the Sequent Voting Platform - uniWAHL Version, depends on independent scrutiny, and we are committed to working with anyone who reports a vulnerability in good faith.

This policy explains what is in scope, how to report, what you can expect from us, and what we ask of you. It also publishes our OpenPGP key for confidential reports and the machine-readable security.txt pointer (RFC 9116).

Version 1.1, 2026-09-09. The authoritative version of this policy is the one published at docs.sequentech.io/docusaurus/main/docs/technology/vulnerability-disclosure-policy; a printed or forwarded copy may be out of date. Changes are announced in the release notes.

Scope​

We accept security reports affecting:

  • Sequent Voting Platform (SVP) components documented on this site.
  • The Sequent Voting Platform - uniWAHL Version. Reports are accepted for the product as delivered and documented; source access is not required in order to report a vulnerability.
  • Deployment configurations and operational guidance described in these docs.

We generally do not accept reports for:

  • Vulnerabilities in third-party infrastructure not operated by Sequent.
  • Issues requiring physical access to consumer-managed environments (unless explicitly in scope for your deployment).
  • Social engineering, phishing, and generic denial-of-service testing against production systems.
  • Findings from automated scanners without a demonstrated security impact.

How to report​

Send your report by email to security@sequentech.io. For sensitive details, encrypt to our OpenPGP key. Encryption is recommended but never required; unencrypted reports are accepted and processed identically.

Reports arriving through any other channel are forwarded to the security team and processed identically.

Please include, where possible:

  • A clear description of the issue and its potential impact.
  • Affected component(s) and version(s).
  • Reproduction steps or a proof of concept (safe and non-destructive).
  • Any relevant logs or screenshots, with sensitive data removed.
  • Your preferred contact details for follow-up, and whether you wish to be publicly credited.

Reports should be submitted in English (Preferred-Languages: en).

Confidential reporting with OpenPGP​

User IDSequent Security Team <security@sequentech.io>
FingerprintDB6B 035E 872A B5DA 90C7 194A 60D3 CBE3 0BAC 91ED
Expiry2028-07-21 (rotated before expiry)
Downloadhttps://keys.openpgp.org/vks/v1/by-fingerprint/DB6B035E872AB5DA90C7194A60D3CBE30BAC91ED
Keyserverkeys.openpgp.org
-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEamDIwRYJKwYBBAHaRw8BAQdAlmcwBCPSg9C+HAkQYIj1+MN1ywdtIuRHTo/O
adTSCsq0LlNlcXVlbnQgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAc2VxdWVudGVj
aC5pbz6ItQQTFgoAXRYhBNtrA16HKrXakMcZSmDTy+MLrJHtBQJqYMjBGxSAAAAA
AAQADm1hbnUyLDIuNSsxLjEyLDAsMwIbAwUJA8JnAAULCQgHAgIiAgYVCgkICwIE
FgIDAQIeBwIXgAAKCRBg08vjC6yR7bLtAQDTo0Eo0b0UohwfK8U2cTjhLewapan6
Gefdsok3rON3jwD/Yl8r9xJGF84E9gNwjZ/IOISYOenCWuFVv8Nwi6/HUgC4OARq
YMkDEgorBgEEAZdVAQUBAQdAV4Fg4HBTjN/E+YWaOB6t8m3iK2wOpRmxkHtQFhXL
exMDAQgHiJoEGBYKAEIWIQTbawNehyq12pDHGUpg08vjC6yR7QUCamDJAxsUgAAA
AAAEAA5tYW51MiwyLjUrMS4xMiwwLDMCGwwFCQPCZwAACgkQYNPL4wuske3dpgD/
fxo+XtUAH+K1CllAL+kK5vAI1/hL3+CHKZYbCuLBR0MA/1atMNNWmjMN3700SC1V
V58EcMyOzioqPKHhFQQoFXYC
=sf9K
-----END PGP PUBLIC KEY BLOCK-----

To import and verify the key:

curl --fail --output pgp-key.txt https://keys.openpgp.org/vks/v1/by-fingerprint/DB6B035E872AB5DA90C7194A60D3CBE30BAC91ED
gpg --show-keys pgp-key.txt   # compare the fingerprint with this page
gpg --import pgp-key.txt

Verify the fingerprint against a second source before use: it is also stated in the operational user guidance and in the delivery documentation provided to consumers. To encrypt a report:

gpg --encrypt --armor --recipient security@sequentech.io report.txt

The key is a role key for the Sequent security team, carries an expiry date, and is rotated before expiry (immediately, on suspicion of compromise). Key rotations are announced in the release notes, and the old key remains available for decrypting reports in transit.

What you can expect from us​

  • Acknowledgement of your report within 5 business days.
  • A point of contact and a tracking reference for follow-up and status enquiries.
  • An assessment of the report (severity is scored with CVSS v3.1) and regular status updates until resolution.
  • Remediation according to our published targets: 30 calendar days for critical and 60 calendar days for high severity issues, with other severities corrected in the next scheduled release. Where a target cannot be met, we communicate an interim mitigation and a revised plan.
  • A security advisory sent directly to every affected consumer, and a public advisory published in the release notes of the release containing the fix.
  • Credit for your finding, if you want it (see Recognition).

What we ask of you​

To protect voters and running elections, we ask reporters to:

  • Act in good faith: avoid privacy violations, data destruction, and degradation of the service.
  • Never test against real elections or production environments. Use local or dedicated test deployments; the Try It Out section explains how to run the platform yourself.
  • Never access, alter, or exfiltrate real voter data or real ballots. If you encounter personal data accidentally, stop, do not copy it, and report immediately.
  • Do not perform denial-of-service, social-engineering, or physical attacks.
  • Give us a reasonable opportunity to investigate and remediate before any public disclosure. We aim to agree on a coordinated disclosure date with you; by default we publish coordinated advisories 7-14 days after a fix release has been made available to affected consumers.

Safe harbor​

We consider security research and vulnerability reporting conducted in accordance with this policy to be authorized and conducted in good faith. We will not initiate legal action or law-enforcement complaints against you for such research, and we waive any claims based on the circumvention of technology controls to the extent that your research complies with this policy. If a third party initiates legal action against you for research conducted in accordance with this policy, we will make it known that your actions were authorized by us.

This safe harbor does not apply to testing against production election systems or real voter data, which is never authorized by this policy.

Recognition​

We are happy to publicly credit reporters who wish to be named. With your permission, your name or handle is listed in the public advisory for the finding. If you prefer to remain anonymous, we respect that.

Security advisories and updates​

Every security fix results in a new release version. Consumers affected by the vulnerability are notified directly, at the contact registered for them when their release was delivered.

The public advisory for a fixed vulnerability is published in the release notes of the release that contains the fix, in the Releases section of this documentation. It describes the nature and effect of the vulnerability, the affected versions, and the corrective action, and it identifies no consumer. Its publication date follows the coordinated disclosure terms above.

security.txt​

This policy and our reporting channels are published in machine-readable form following RFC 9116:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Sequent Tech - coordinated vulnerability disclosure (RFC 9116)

Canonical: https://docs.sequentech.io/docusaurus/main/.well-known/security.txt
Contact: mailto:security@sequentech.io
Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/DB6B035E872AB5DA90C7194A60D3CBE30BAC91ED
Policy: https://docs.sequentech.io/docusaurus/main/docs/technology/vulnerability-disclosure-policy
Acknowledgments: https://docs.sequentech.io/docusaurus/main/docs/technology/vulnerability-disclosure-policy#recognition
Preferred-Languages: en
Expires: 2028-07-01T00:00:00.000Z
-----BEGIN PGP SIGNATURE-----

iJEEARYKADkWIQTbawNehyq12pDHGUpg08vjC6yR7QUCanBJbBsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwwLDMACgkQYNPL4wuske1G6wD+NziZBacawZPZkYPb3FW8
RJn48xotxfMRfZsuhaH3zbUBAMxdPqZE5a9ZLpN0gHUvRpUOzKVLeo3lT6y+P1aS
6zwB
=H7TJ
-----END PGP SIGNATURE-----

The version-controlled, digitally signed master copy lives in this repository (docs/docusaurus/static/.well-known/security.txt), is embedded above verbatim, and is published with this documentation site at https://docs.sequentech.io/docusaurus/main/.well-known/security.txt. The file is clear-signed with the security team OpenPGP key, and its Expires value is renewed together with the periodic key review, before it lapses.