Report a vulnerability.
We build software that sits inside security-sensitive environments, and we take reports about it seriously. If you believe you have found a vulnerability in FalseTrail or on falsetrail.com, please tell us.
Email security@falsetrail.com
Please include what you found, where, how to reproduce it, and the impact you expect. If you have a proof of concept, include it. Write in English or Turkish.
Our contact details are also published in machine-readable form at /.well-known/security.txt.
- We will acknowledge your report, keep you informed while we investigate, and tell you when it is fixed.
- Give us reasonable time to fix the issue before you disclose it publicly. We will agree a disclosure date with you.
- Act in good faith. Only test against systems you own or are authorised to test, avoid accessing or changing other people’s data, and don’t degrade service for others.
- Credit is yours if you would like it once the issue is resolved.
What the product does, and doesn’t, do.
These boundaries describe the customer-hosted product as it ships today. The deployment page covers each one in detail.
No outbound telemetry
The customer-hosted installation makes no FalseTrail-originated outbound connections and sends no telemetry. This is tested at the socket layer.
Evidence stays local
Raw evidence stays on the FalseTrail host. Findings leave only through a notification file the customer’s own forwarder ships.
Not a production proxy
Production traffic never routes through FalseTrail. Decoys are reachable only by following something the customer planted.
No broad administrative access
FalseTrail never touches other hosts, directory services, EDR, MDM, SIEM APIs or real credentials. Placements are deployed by the customer’s own tooling.
Synthetic only
Decoys hold no real data, issue material that works only in the synthetic world, and never build responses from request bytes.
Least privilege on the host
An unprivileged service user, a hardened systemd unit, owner-only data and a console bound to loopback.