We welcome reports about the security of LexInsight. If you think you have found a vulnerability, tell us so we can fix it.
How to report
Email info@lexinsight.co with:
- a description of the issue and where you found it;
- the steps to reproduce it;
- the potential impact as you understand it;
- how we can reach you if we need to ask a question.
Please do not open a public issue, and do not post details publicly until we have had a chance to respond.
What is in scope
- the LexInsight website and order flow;
- the intake, upload, and checkout steps;
- report access and report download;
- the API routes used by the site.
What is out of scope
- denial-of-service and load testing;
- automated scanning that degrades the service;
- social engineering against our team or any of our providers;
- physical access attacks;
- reports produced only by an automated tool, with no explanation of impact.
Testing boundaries
If you test, stay inside these limits:
- test only against accounts, orders, and documents you created yourself;
- do not access, modify, or retain another person's data;
- do not degrade the service or run load or denial-of-service tools;
- stop as soon as you confirm a vulnerability, and do not expand the test;
- give us a reasonable time to fix the issue before you disclose it publicly.
What we ask of you
- Do not use a finding to access data that is not yours.
- Do not retain another person's data longer than you need to show the issue.
- Do not extort, threaten, or demand payment.
What we offer
We will confirm we received your report, tell you what we found when we have assessed it, and credit you if you would like. We do not run a bug bounty program and we do not promise payment for a report. This page is not a promise of a reward.
Good faith
We will not pursue legal action against someone who reports a security issue in good faith and stays within this page. The Acceptable Use Policy permits this testing, and this page describes its boundaries.