Get started
Help / Policies and legal

Vulnerability disclosure policy

How to report a vulnerability, the research we permit, and how we treat reporters.

UNCHAIN, Inc. welcomes researchers who help improve the security of Pulse. This policy sets out the scope within which you may research vulnerabilities, the conduct to which UNCHAIN, Inc. gives its consent in advance, how to report, and what UNCHAIN, Inc. does once a report is received.

How this policy is constructed

Japan's Act on Prohibition of Unauthorised Computer Access prohibits circumventing an access control function to reach a protected area. In its definitions, the Act excludes acts “done with the consent of the access administrator”. This policy is not merely a statement that we will not take legal action: it is constructed as a document by which UNCHAIN, Inc., as the access administrator of Pulse, gives its consent in advance within a defined scope and on defined conditions.

LegislationAct on Prohibition of Unauthorised Computer Access, Article 2, paragraph 4 (definitions)

Unauthorised computer access is defined as: (i) entering another person's identification code so as to make restricted use available; (ii) entering information or commands other than an identification code so as to circumvent an access control function and make restricted use available; and (iii) doing the same in respect of use restricted by the access control function of another computer. In each case, acts “done by the access administrator who added that access control function, and acts done with the consent of that access administrator …” are excluded. The consent given by this policy corresponds to that exclusion.

LegislationAct on Prohibition of Unauthorised Computer Access, Article 3 (prohibition) / Article 11 (penalties)

No person may commit an act of unauthorised computer access; a breach is punishable by imprisonment for up to three years or a fine of up to ¥1 million. Research beyond the scope of this policy risks falling foul of that provision.

Article 1 (Purpose)

  1. The purpose of this policy is to set out, in respect of finding and reporting vulnerabilities in Pulse, the scope and conditions of the research to which UNCHAIN, Inc. consents, how to report, and UNCHAIN, Inc.'s approach to responding.
  2. This policy takes precedence over the terms of service, Article 12, item 11; the application terms of service, Article 3, paragraph 3, item 2; and the API and platform terms of service, so as to permit research carried out within its scope.
  3. Notices concerning infringement of copyright or other rights are outside this policy. The procedure is as set out in Copyright infringement notices.

Article 2 (Who gives the consent)

  1. The consent under this policy is given by UNCHAIN, Inc., the access administrator of the equipment and services comprising Pulse.
  2. UNCHAIN, Inc. can give consent only in respect of equipment and services it manages. It is not in a position to give consent in respect of equipment and services managed by third parties, or information in which other users have rights.

Article 3 (Scope of permitted research)

  1. UNCHAIN, Inc. consents to research on the following assets, carried out in accordance with the conditions in this policy.
  2. The web application at the-unchain.com and the subdomains UNCHAIN, Inc. operates for Pulse
  3. Pulse's API endpoints
  4. The Pulse desktop app (macOS and Windows)
  5. The browser extensions Pulse provides
  6. UNCHAIN, Inc. updates the scope of the assets in the preceding paragraph on this page from time to time. Where it is unclear whether something is in scope, enquire at tharada@the-unchain.com before beginning research.
About listing the assets in scope

Replace the domains, apps and extensions listed in Article 3, paragraph 1 with the list of assets UNCHAIN, Inc. actually operates. Writing “our services generally” without identifying them leaves the scope of the consent unclear and weakens the legal effect of this policy.

Article 4 (Conduct not covered by the consent)

The following are not covered by the consent under this policy. UNCHAIN, Inc. gives no consent to them, and legal liability may arise.

  1. Research against services provided by third parties (cloud infrastructure, identity platforms, payments, support ticketing, analytics, error monitoring and the like)
  2. Signing in, or attempting to sign in, to another user's account without authority
  3. Reaching, obtaining, viewing or storing another user's notes, transcripts or other information
  4. Destroying, altering, encrypting or deleting data
  5. Testing involving denial of service (DoS or DDoS), and high-load testing against production
  6. Large-scale automated scanning that affects the availability of production
  7. Social engineering or phishing, or attempts at it, directed at UNCHAIN, Inc.'s officers and employees, its suppliers or its users
  8. Entering, or attempting to enter, physical premises of UNCHAIN, Inc. or its suppliers
  9. Installing malware or a backdoor, or otherwise creating a persistent foothold
  10. Using a vulnerability found to escalate privileges beyond the purpose of the research
  11. Providing information obtained to a third party, or publishing it
LegislationPenal Code, Article 234-2 (obstruction of business by damaging a computer) / Civil Code, Article 709 (damages for tort)

Obstructing business by giving improper commands to a computer and similar conduct is punishable under the Penal Code. Infringing another person's rights or legally protected interests gives rise to liability in damages under the Civil Code. Load testing and reaching other users' data risk falling foul of these provisions.

LegislationAct on Prohibition of Unauthorised Computer Access, Articles 4, 5 and 6 (prohibition of improperly obtaining, facilitating the use of, and improperly storing identification codes)

Improperly obtaining another person's identification code, providing it to a third party, and improperly storing it are all prohibited. Where research brings you to another user's credentials, do not obtain or store them: stop the research at once and report it.

Article 5 (The consent and its conditions)

  1. UNCHAIN, Inc. gives its consent in advance, as the access administrator for the purposes of Article 2, paragraph 4 of the Act on Prohibition of Unauthorised Computer Access, to research on the assets in Article 3 that satisfies all of the following conditions.
  2. The accounts used for research are limited to test accounts the reporter has properly opened themselves
  3. None of the conduct listed in Article 4 is carried out
  4. Operations are kept to the minimum needed to confirm that the vulnerability exists, and research stops promptly once it is confirmed
  5. Where research brings you to another user's information, its contents are not viewed, stored, copied or used; research stops at once and the matter is reported to UNCHAIN, Inc.
  6. The vulnerability found is reported to UNCHAIN, Inc. following the procedure in Article 8
  7. The coordination of publication in Article 9 is followed
  8. UNCHAIN, Inc. will not take legal action against a reporter in respect of research carried out satisfying the conditions in the preceding paragraph.
  9. Where a third party enquires about such research, UNCHAIN, Inc. will explain that the conduct was based on UNCHAIN, Inc.'s consent.

Article 6 (Limits of the consent)

  1. The consent under this policy is limited to equipment and services UNCHAIN, Inc. manages.
  2. This policy does not give consent in respect of other users' privacy or any other third party's rights.
  3. This policy does not bind investigating authorities or the courts in criminal proceedings.
  4. Where a reporter departs from the conditions in Article 5, paragraph 1, the consent does not extend to the conduct that departs from them.

Article 7 (Things to check before reporting)

  1. Matters already published in this help centre, and points about generally known configuration recommendations, are as a rule not treated as new reports.
  2. Reports consisting only of points about configuration values with no actual impact (email authentication settings, the presence or absence of security headers, exposure of version information and the like) may be given lower priority.
  3. For reports consisting of the output of an automated scanner sent as it stands, we may ask for steps to reproduce.

Article 8 (How to report)

  1. Vulnerabilities are to be reported by email to tharada@the-unchain.com.
  2. So far as possible, a report should state the following.
  3. The asset concerned (URL, endpoint, type and version of the app)
  4. The type of vulnerability and a summary
  5. Steps to reproduce (including screenshots, records of requests and responses, and proof-of-concept code)
  6. The impact you expect
  7. The date and time of the research and the account used
  8. The reporter's name or handle, and contact details
  9. Where a report contains personal data or other confidential information, include only the minimum necessary and say that it is there.
  10. Reports may be made in Japanese or English.

Article 9 (Coordinating publication)

  1. A reporter is not to disclose the substance of a report to third parties until UNCHAIN, Inc. has completed a fix.
  2. The period in the preceding paragraph is capped at 90 days from receipt of the report. Where a fix is not complete within 90 days, UNCHAIN, Inc. will discuss the timing of publication with the reporter.
  3. Where a reporter publishes the substance of a report, UNCHAIN, Inc. would like to review the content beforehand. This is to ensure it contains nothing from which other users' information could be inferred.
  4. UNCHAIN, Inc. may publish the background to, and its response to, an event found to have affected users. Publication takes the form of a summary, how it arose, what was done, who was affected, preventing recurrence, acknowledgements and further reading, in that order. For an example, see Report: a navigation vulnerability in the desktop app.

Article 10 (How we treat reporters)

  1. On receiving a report, UNCHAIN, Inc. will as a rule acknowledge receipt within three business days.
  2. After receipt, UNCHAIN, Inc. will investigate reproducibility and impact and inform the reporter of the outcome.
  3. UNCHAIN, Inc. will share its approach to a fix and the expected timing with the reporter so far as it can.
  4. Once a fix is complete, UNCHAIN, Inc. may contact the reporter and ask them to confirm it.
  5. If the reporter wishes, UNCHAIN, Inc. will name them, or use their handle, in the acknowledgements of any published material. If you would rather not be named, please tell us.
About the timescales

The number of business days in Article 10, paragraph 1 and the 90 days in Article 9, paragraph 2 are given as a common example of practice. Settle them against UNCHAIN, Inc.'s actual security response arrangements. Publishing deadlines you cannot in fact meet damages the relationship with reporters rather than helping it.

Article 11 (Bounties)

About whether bounties are paid

State, in accordance with UNCHAIN, Inc.'s policy, whether a bounty is paid for vulnerability reports and, if so, the basis for the amount, the severity bands covered and the conditions of payment. Where no programme exists, the usual practice is to say plainly “there is no bounty programme for reports under this policy”, adding that one is planned where that is so. Whether bounties are paid has no bearing on the legal effect of this policy, and the consent in Article 5 is not limited by the absence of a bounty.

Article 12 (Using the public reporting scheme)

  1. A reporter may, instead of or in addition to reporting to UNCHAIN, Inc., report through the Information Security Early Warning Partnership operated by the Information-technology Promotion Agency (IPA).
  2. That scheme is a public-private framework based on the “Standards for Handling Software Vulnerability Information and Others” (a notification of the Ministry of Economy, Trade and Industry), under which IPA receives reports and JPCERT Coordination Center (JPCERT/CC) coordinates.
  3. Where UNCHAIN, Inc. receives a coordination request through that scheme, it will endeavour to respond in line with those guidelines.
Where the public scheme sits

The Information Security Early Warning Partnership is not itself legislation; it is a recommended public-private framework based on a ministerial notification. IPA makes clear that it does not compel a business that receives a report to keep it confidential, to take countermeasures or to fix it. Consider it, alongside reporting directly to UNCHAIN, Inc., as the usual route for reporting a vulnerability found in Japan.

Article 13 (Changes to this policy)

  1. UNCHAIN, Inc. may change the contents of this policy.
  2. Where it does, UNCHAIN, Inc. will post the changed contents and the date they take effect on this page.
  3. The lawfulness of research is judged by the contents of this policy in force at the time the research was carried out.

Supplementary provisions

  1. This policy takes effect on Please contact us.
  2. Reports: tharada@the-unchain.com
  3. Other enquiries: tharada@the-unchain.com

Related articles

← Terms of serviceSigning in and connecting your calendar →
Last updated:14 September 2026