MCP Servers - Security Policy

This Security Policy describes how to report security vulnerabilities in the Kaseya Insights Community and how Kaseya will respond. We take security seriously and appreciate responsible disclosure.

Security fixes are provided for the two most recent versions of feature releases.

To report a vulnerability, please report the vulnerability privately to Kaseya at _______________.

Please do not report security vulnerabilities through public GitHub Issues, pull requests, or community forums. Public disclosure before a patch is available puts all users at risk.

Your report should include:

• A description of the vulnerability and its potential impact;
• All occurrences within the project of the vulnerability that you know of;
• Step-by-step instructions on how to reproduce the vulnerability, including any exploit code;
• Any proof-of-concept code, if available;
• Screenshots or videos demonstrating the issue;
• Operating system and/or version information, if relevant;
• A log of activity related to your discovery, including IP addresses, if applicable.
• Your name and contact information (optional, but helpful for follow-up).

Upon receiving a vulnerability report, Kaseya will use commercially reasonable efforts to:

• Confirm receipt within 48 hours.
• Investigate and assess the severity within 14 days.
• Keep the reporter informed of progress.
• Develop and test a fix.
• Release a patched version and publish a security advisory.
• Credit the reporter in the advisory (unless the reporter requests anonymity).

We aim to resolve critical vulnerabilities as soon as possible. We will coordinate disclosure timing with the reporter and will not disclose publicly until a fix is available, except in cases where the vulnerability is already being actively exploited in the wild.

We follow a coordinated disclosure model. We ask that reporters:

• Allow us a reasonable time to investigate and release a fix before disclosure to third parties.
• Avoid exploiting the vulnerability beyond what is necessary to demonstrate the issue.
• Avoid accessing, modifying, or deleting data belonging to others.
• Avoid denial of service attacks or any other attacks that have a reasonable chance of degrading the community experience.

In exchange, we commit to:

• Responding promptly and keeping you informed.
• Working in good faith to address the vulnerability.
• Publicly acknowledging your contribution, if you wish.

This policy applies to:

• [List in-scope systems, e.g., the main project repository, official hosted instances, etc.]

The following are out of scope:

• Vulnerabilities in third-party dependencies (please report those to the relevant upstream project);
• Issues that require physical access to a device;
• Social engineering attacks; and
• Contributions that do not originate from Kaseya.

We consider security research conducted in accordance with this policy to constitute authorized access. Participants hereby agree that they will not initiate or recommend legal action against researchers who comply with this policy.

If at any time you have concerns or are uncertain whether your research is consistent with this Policy, please contact a Maintainer and pose the question.

Security services provided to the community are voluntary, and “AS IS” without warranty. Participants engage with the community and Contributions at their own risk. More detailed disclaimers and language regarding the waivers of claims related to the community and its security can be found in Disclaimers.