Security
If you believe you have found a vulnerability in anything we run, please tell us before you disclose it elsewhere. We aim to make reporting straightforward, so that we do not learn of a finding through a third party.
Email security@legisgate.com with enough detail to reproduce the issue: the URL or endpoint, the steps, and what you observed. A short proof of concept is more useful than a long description.
If the finding involves data belonging to somebody else, please tell us what you saw but do not retain it, and do not access more than the minimum needed to demonstrate the issue.
On legal protection for researchers. We do not want anybody acting in good faith to be in doubt about their position, and the operative wording that governs it belongs in counsel-approved terms rather than in a summary on this page. Contact us and we will provide the current language. If you are unsure whether something is in scope, report it and ask — we would rather answer that question than not hear from you.
In scope, and out
If an issue is on neither list and you believe it is significant, please report it.
Anything that lets one tenant reach another tenant’s data. Authentication and authorization flaws. Injection. Exposure of intake content or generated documents. Anything that would let a determination be altered after issue.
Missing headers with no demonstrated impact, rate-limit observations on unauthenticated marketing pages, reports produced entirely by a scanner with no verification, and issues in third-party services that are better reported to that provider.
Thank you
A vulnerability reported privately is a defect to be corrected. The same vulnerability found by someone else may become a security incident. We prefer to receive the report.