Support and reporting

Email support@dustidentity.com for help with DICE, the DUST API, DUST Go, or any other DUST product. Anyone can use the same address to report a problem with the security, privacy, accuracy, or availability of our services, whether or not they are a customer. People at DUST Identity read every message.

If you are signed in to DICE, you can also open the user menu and choose Help → Contact support.

What to report

Report any of the following, even if you are not sure it is a problem:

• Security: a suspected vulnerability, unauthorized access to an account or data, a lost or exposed API key, or a message that claims to come from DUST Identity and asks for credentials.
• Confidentiality: information that someone can see but should not, or data shared outside the Organization or Team it belongs to.
• Integrity: Threads, Identifiers, files, or scan results that are wrong, changed unexpectedly, or appear to have been tampered with.
• Availability: DICE, the DUST API, or DUST Go is down, unreachable, or too slow to use.
• Incidents and concerns: anything you believe has gone wrong, or could go wrong, in how DUST Identity protects your data or delivers its services.
• Complaints: about our products, our service, or how an earlier report was handled.

How to report

Send an email to support@dustidentity.com that includes:

1. What happened and when, including the time zone.
2. Where it happened: the product, the page or URL, or the API endpoint.
3. Who is affected: your Organization, if you are a customer, and how to reach you.
4. How to reproduce it: the steps, error messages, screenshots, and the request ID if the DUST API returned one.
5. The impact: what you cannot do, and whether the problem is still happening.

For a security or confidentiality problem, start the subject line with Security so that we triage it ahead of routine requests.

Never send secrets

Do not include passwords, API keys, or other credentials in a report. If you believe a credential has been exposed, tell us and revoke it; Rotate a key explains how. If a report needs to include your data, describe the data instead of attaching it. We will arrange a secure way to receive it if we need it.

What happens next

1. We acknowledge your report and tell you who is handling it.
2. We investigate. We handle security, confidentiality, integrity, and availability reports as potential incidents, and they take priority over routine requests.
3. We keep you informed while we work on it, and tell you when and how it was resolved.

If your Organization has a support agreement with DUST Identity, the terms of that agreement also apply.

Reporting a vulnerability

We welcome reports from security researchers. When you look for or report a vulnerability:

• Give us a reasonable amount of time to fix it before you disclose it publicly.
• Test only with accounts and data that you own or are authorized to use.
• Do not access, change, or delete other people’s data, degrade the service for other users, or use social engineering against our staff or customers.

Our machine-readable contact details are published at /.well-known/security.txt.