Vulnerability reporting policy.
As part of our ISO 27001 security controls, we operate a coordinated vulnerability disclosure policy. If you find a potential security issue in any service operated by Lithus, here is how to report it to our engineering team and what to expect.
How to report
Email [email protected]. Our engineering team reads this address every working day.
If your report needs urgent action, please say so in the subject line.
Please include enough detail for us to understand and reproduce the issue, such as the affected URL or hostname and what you observed.
What happens next
- We acknowledge every report within 1 working day.
- We investigate the issue and assess its severity within 5 working days.
- We let you know when the fix is deployed.
Scope
You can use this address to report a security issue affecting any Lithus domain or any service that we operate.
We do not run a public bug bounty programme, and this policy does not authorise active security testing against our services or our clients' systems.
Prohibited actions
- Do not run automated scanners, penetration tests, or denial-of-service tests against our services or our clients' systems.
- Do not access, modify, or download data that does not belong to you.
- Do not use social engineering or phishing against our staff or our clients.
Good-faith reporting
If you discover a security issue and report it to us in good faith, without accessing or keeping other people's data, without disrupting any service, and while giving us reasonable time to fix the issue before disclosing it to anyone else, we will not take legal action against you over your report.