Security and Vulnerability Disclosure Policy

Traffic between your device and the Service is encrypted in transit using TLS.

Passwords are stored only as salted cryptographic hashes and are never recoverable.

Data at rest is encrypted by our storage providers.

Access to production systems and data is restricted to personnel who require it, and is logged.

Authentication endpoints are rate limited and monitored for automated abuse.

Sessions expire and tokens are rotated.

Dependencies are monitored for known vulnerabilities and updated.

We do not claim the Service is perfectly secure. No system is, and a claim to the contrary would be worthless.

Send reports to security@lacspace.com with "Vulnerability" in the subject line.

Include the affected URL or endpoint, the steps to reproduce, and the impact you believe it has.

Include a proof of concept where you can do so without accessing another person's data.

We acknowledge every report within three working days.

We give an initial assessment within ten working days.

We keep you informed while we work on a fix, and we tell you when it is deployed.

We ask that you do not disclose publicly until a fix is deployed, or ninety days have passed, whichever is sooner.

You do not need an account to report, and we accept anonymous reports.

We will not bring or support legal proceedings against a person conducting security research in good faith within the rules in this policy.

We will not report good-faith research to law enforcement.

We consider such research authorised access for the purposes of any law restricting unauthorised access.

If a third party brings proceedings in respect of research conducted within these rules, we will make clear that it was authorised.

Safe harbour is lost if you access, copy or retain another person's data, degrade the Service, extort us, or disclose in breach of the timescales above.

If you are unsure whether an action is within scope, ask before you take it.

Testing against your own account and your own content.

Passive observation of responses, headers and client-side code.

Testing for injection, authentication, authorisation and access-control flaws using your own data.

Reporting misconfiguration of storage, headers, certificates or DNS.

Reporting a dependency with a known vulnerability.

Testing that stops at the first proof that a flaw exists.

Accessing, downloading, modifying or retaining any data belonging to another person.

Denial of service testing, load testing, or anything that degrades the Service for other users.

Social engineering of our staff, our users, our contractors or our suppliers.

Physical attacks on any premises or equipment.

Spam, phishing or any test conducted against a third party's system.

Automated scanning that generates a volume of traffic capable of affecting availability.

Retaining a copy of anything you obtained during testing after you have reported it.

Publishing details of an unfixed vulnerability.

Reports produced solely by an automated scanner without a demonstrated impact.

Missing security headers with no demonstrated exploit.

Weaknesses in third-party services we do not control.

Issues requiring physical access to an unlocked device.

Self-inflicted issues requiring the victim to paste code into a console.

Best-practice recommendations without a security impact.

Rate limiting on endpoints where a limit exists and functions.

We do not operate a paid bug bounty programme, and we say so rather than implying one.

We credit reporters publicly where they wish to be credited.

We will provide a written acknowledgement of a valid report on request.

We prioritise fixing over negotiating about severity.

A report that leads to a material fix is acknowledged in the relevant version history.

We investigate immediately and take steps to contain the incident.

Where a breach is likely to result in a risk to users, we notify affected users and the relevant authority without undue delay, and in any event within seventy-two hours of becoming aware of it.

A notification states what happened, what data was involved, what we have done, and what you should do.

We do not delay notification in order to complete an investigation first.

We publish a post-incident account where doing so does not create further risk.

We preserve incident records for at least five years.

We do not retaliate against a person who reported the issue that led to the discovery.