Lavder Enterprise builds systems that hold client data. We take reports seriously and we do not punish people for finding problems.
Do not open a public issue for a security problem.
Report it privately, either way:
- GitHub — open a private security advisory on the affected repository. Preferred: it keeps the report attached to the code.
- Email — info@lavder.com, subject line starting with
SECURITY:.
Please include:
- what the issue is and which repository, version or deployment it affects
- the steps to reproduce it, or a proof of concept
- what an attacker gets out of it
- anything you already know about a fix
If you need to send us something sensitive, say so in the first message and we will arrange an encrypted channel before you send it.
| Stage | Target |
|---|---|
| We acknowledge your report | within 3 working days |
| We confirm or reject the finding, with reasoning | within 10 working days |
| We ship a fix, or give you a dated plan | within 90 days of confirmation |
If a report affects a client deployment rather than our own code, we notify the client and coordinate the timeline with them. We will tell you that this is happening.
In scope — any repository in this organisation, and any service we run at a lavder.com hostname.
Out of scope — client-owned infrastructure we did not build, third-party services we merely consume, reports generated by an automated scanner with no demonstrated impact, and findings that require a compromised device or a privileged account you already control.
Test only against your own accounts and data. Do not run denial-of-service tests, do not pivot beyond the minimum needed to prove the finding, and do not access, modify or retain anyone else's data. If you hit real user data by accident, stop and tell us.
Stay inside those lines and we will not pursue legal action over your research.
We credit reporters by name in the advisory and the release notes, unless you ask us not to. We do not currently run a paid bounty programme.