Vulnerability disclosure policy

Introduction

Limina AB is committed to ensuring the security and integrity of our systems and data. We recognise the important role that independent security researchers and our user community play in maintaining high security standards. In support of this commitment, we have established this Vulnerability disclosure policy (VDP) to provide guidance on how to communicate potential security vulnerabilities to us responsibly.

Scope

This policy applies to any digital assets owned, operated, or maintained by Limina AB. It is intended for security researchers, customers, and other stakeholders who may discover security vulnerabilities associated with these assets.

Compliance Standards

This VDP is designed to be compliant with ISO 27001, IASME Governance, and SOC2 standards, ensuring a systematic approach to managing and reporting vulnerabilities while protecting sensitive information.

Reporting a Vulnerability

1. Contact: Security vulnerabilities should be reported via our designated reporting channel at vulnerabilities@limina.com.
2. Information Required: Please provide a detailed description of the vulnerability, including the target, steps to reproduce, and potential impact. Where possible, include proof-of-concept code or screenshots.
3. Responsible Disclosure: We ask that you keep your findings confidential and do not publicly disclose them until we have had the opportunity to investigate and address the reported issue.

Our Commitment

Upon receiving a vulnerability report, Limina AB commits to the following:

1. Acknowledgment: We will acknowledge receipt of your report within 48 hours.
2. Evaluation: We will evaluate the reported vulnerability in the context of our environment and in accordance with our risk management framework, consistent with ISO 27001 and IASME governance principles.
3. Communication: We will maintain open communication with the reporter, providing updates on our progress toward resolving the vulnerability.
4. Remediation: We are committed to timely remediation of validated vulnerabilities. The timeframe for remediation will depend on the severity and complexity of the reported issue.
5. Recognition: We believe in recognising the efforts of security researchers and will discuss the possibility of acknowledgment after the vulnerability has been validated and resolved.

Legal Safe Harbor

Limina AB commits not to pursue legal action against individuals who submit vulnerability reports in compliance with this policy and who conduct themselves ethically and responsibly. This includes providing us with a reasonable amount of time to address the issue before any public disclosure is made.

Policy Updates

This policy may be updated periodically to reflect changes in our security posture, compliance requirements, or feedback from the community.

Last revision: 2024-06-10