Skip to content
Security

Reporting a vulnerability

If you have found a security problem in something we run, we want to hear about it, and we will treat you as somebody doing us a favour.

How to report

Email security@lambda-twelve.com. Tell us what is affected, how to reproduce it, and what you think the impact is. A proof of concept helps; so does the time you tried it, and the address you tried it from, so we can find it in our logs.

English or Greek, whichever you prefer. One problem per email makes each one easier to track.

What we do

  • We acknowledge your report within 3 working days.
  • We tell you within 10 working days whether we can reproduce it, and what we plan to do.
  • We keep you updated until it is fixed, and tell you when it is.
  • If you would like credit, we will name you when we publish the fix; if you would rather not be named, we will not.

We do not run a paid bug bounty.

What is in scope

  • www.lambda-twelve.com and lambda-twelve.com, including the customer portal;
  • our other hosts under lambda-twelve.com, and l12.gr;
  • the infrastructure our hosting runs on.

A website or application we host for a customer belongs to that customer. Problems in their own code are theirs to fix, and the best route is to tell them. Tell us as well if the problem is in our platform rather than in their application, or if you cannot reach them.

What we ask of you

  • Access no more data than you need to show the problem, and keep none of it.
  • Do not change or delete anything, and do not leave anything behind.
  • Do not degrade the service for anybody else: no denial of service, and no load testing.
  • Do not use social engineering, phishing or physical access, on us or on our customers.
  • Give us a reasonable time to fix it before you publish anything. 90 days is the usual figure; tell us if you need it to be different, and we will agree a date with you.

Things we do not need reports about

  • Missing headers or settings, with no way to show they cause harm.
  • Findings from an automated scan, with no demonstrated impact.
  • Software versions, without a vulnerability that affects us.
  • Spam, or the lack of rate limiting on a form, unless it leads to something more.

Legal

If you act in good faith and within this policy, we will not take legal action against you, or ask anybody else to, for your research. If somebody else does, we will make it known that you acted with our authorisation. If you are not sure whether something is within this policy, ask us first at security@lambda-twelve.com.

Lambda Twelve's own contact details are in the Legal Notice.