Responsible Disclosure

Summary

Report a vulnerability privately to security@logethos.com and give Logethos a reasonable chance to fix it before publishing. Test only against your own accounts, do not degrade the service, and research conducted within this policy will not be met with legal action.

This policy covers every system Logethos operates, not one product.

1. Scope

In scope:

• logethos.com and its subdomains.
• The hosted applications Logethos operates, including Evigate at evigate.logethos.com, and their APIs.
• The infrastructure Logethos runs directly on its own server: the reverse proxy configuration, exposed services, and the deployed application images.

If you are not sure whether something belongs to Logethos, ask at security@logethos.com before testing it.

2. How to report

Email security@logethos.com with:

• What the issue is and what an attacker could do with it.
• Steps to reproduce it, with a minimal proof of concept if you have one.
• The affected URL, endpoint, and parameters, with secrets and any other person's data removed.

Do not include real customer data in a report. If you can encrypt the sensitive parts, do.

3. Rules of engagement

Do:

• Test against accounts and data that are yours.
• Stop as soon as you have confirmed the issue, and report it.
• Keep the details private until it is fixed. Ninety days is the default coordinated disclosure window, and a shorter one is fine by agreement.

Do not:

• Read, change, or extract data that is not yours, or attempt to cross a tenant or project boundary against a real organisation.
• Run denial-of-service, load, or volumetric tests.
• Phish, social engineer, or otherwise target the operator or any user.
• Point a high-volume automated scanner at production without arranging it first.
• Publish before the issue is fixed or the agreed window has passed.

4. Out of scope

Reports in these categories are generally not treated as vulnerabilities unless you can demonstrate real impact:

• A missing security header or cookie flag with no working exploit.
• Rate-limit thresholds, self-XSS, or clickjacking on a page with nothing sensitive on it.
• Output from an automated scanner with no proof of concept.
• Issues in a third-party provider's own systems. Report those to that provider; the vendors are listed at Subprocessors.
• Issues in a deployment run in someone else's infrastructure, caused by that environment or its configuration.
• Anything that depends on an already compromised device or account.

5. Commitments

Logethos undertakes to:

• Acknowledge a report within five working days. This is an operator commitment rather than a contractual one. Logethos is a sole proprietorship with no on-call rota, so the acknowledgement window is stated at a length that can actually be met rather than at a length that sounds impressive.
• Give a triage assessment with a severity view once the report has been reproduced.
• Keep the reporter informed while the fix is in progress.
• Fix valid issues in order of severity, and use the emergency change path where the severity warrants it.
• Take no legal action over research conducted within this policy.

6. Safe harbour

Security research carried out in line with this policy is authorised. Logethos will not initiate legal action over it, and will say so on the record if a third party raises a claim about good-faith, in-scope research.

Activity that breaks the rules in section 3, or that breaches the acceptable use terms of the product being tested, is not authorised and is not covered by this section.

7. Recognition

Researchers who report a valid issue are credited, with their permission, once the fix has shipped. Logethos runs no paid bug bounty. If that changes, the rewards and their scope will be published here.

8. Contact

security@logethos.com for vulnerability reports. privacy@logethos.com for a question about data handling rather than a vulnerability.