Vulnerability Disclosure

founder@liberraai.com

Include what you found, the steps to reproduce it, and what an attacker could do with it. A short working proof of concept is worth more than a long description. Please do not open a public GitHub issue for a security problem. Use the address above.

• We reply within 3 working days. To acknowledge. Not to have fixed it.
• We tell you what we found. Whether we agree it is a vulnerability, and what we are doing about it.
• We credit you if you want it. Publicly, on this page, once the fix is live. Or not at all, if you prefer.
• We will not sue you. See the safe harbour below. It is the whole reason this page exists.

We are a small team. Those are commitments about responsiveness and conduct, not about how fast a fix ships. That depends on what you find.

If you make a good faith effort to comply with this policy during your research, we will consider your research to be authorised, we will work with you to understand and resolve the issue quickly, and Liberra AI will not recommend or pursue legal action related to your research.

If a third party initiates legal action against you in connection with activities conducted under this policy, we will make this authorisation known.

This safe harbour applies as long as you: give us reasonable time to respond before disclosing publicly; do not access, modify, or destroy data that is not yours; do not degrade our service or our customers' services; and stop and tell us the moment you encounter another user's data.

Test against your own account. Specifically:

• Create your own Liberra account and connect your own cloud account.
• Do not attempt to access another customer's data, cloud account, chat history, or Cloud Index. If you find a way to, that is exactly the report we want. Describe the path, do not walk down it.
• No denial of service, load testing, or spam against our systems or our customers'.
• No social engineering of our team, our customers, or our vendors. No physical testing.

These are usually not something we will act on:

• Reports from automated scanners with no working proof of concept.
• Missing security headers, cookie flags, or TLS configuration with no demonstrated impact.
• Rate limiting on unauthenticated marketing pages.
• Self-XSS, clickjacking on pages with no state-changing action, or issues needing a rooted device or a physically stolen machine.
• Anything in AWS, Azure or Google Cloud itself. Report those to the provider.
• A customer’s own cloud misconfiguration that Liberra reports on. That is the product working.

If you think one of these has real impact in our specific case, send it anyway and say why. The list is a default, not a wall.

We do not currently pay for vulnerability reports. We are not going to imply that we might. What we offer is a fast, human reply, public credit if you want it, and a straight answer about what we are doing with what you found.

Before you start, the security page describes what Liberra can and cannot do to a connected cloud account, and the public security repo carries the enforcement code and the exact templates every customer deploys. Both are there so you can aim at something real instead of guessing.