Introduction
Lineaje is committed to maintaining the security and integrity of its products and services. We recognize that security vulnerabilities can occur and that responsible disclosure is essential for addressing these issues promptly and effectively. This Vulnerability Disclosure Program (VDP) outlines the process for reporting vulnerabilities to Lineaje and how such reports are handled, including strict confidentiality and anonymity requirements.
Reporting a Vulnerability
Contact Information
To report a vulnerability in Lineaje products or services, please use one of the following methods:
Email: security@lineaje.com and CC: anand@lineaje.com
Initial Report Requirements
When reporting a vulnerability, please include the following information to help us assess and address the issue effectively:
- Vulnerability Details: A clear description of the vulnerability, including steps to reproduce.
- Supporting Evidence: Relevant artifacts such as HTTP requests/responses, HTML snippets, screenshots, or proof-of-concept code.
- Impact Assessment: Description of the potential security or business impact.
- Optional Contact Information: Contact details may be provided to enable follow-up but are not required.
Disclosure & Confidentiality Policy
Responsible Disclosure
Lineaje follows the principles of responsible disclosure and adheres to guidance from the Open Web Application Security Project (OWASP) and the ISO/IEC 29147 standard.
Confidentiality & Non-Disclosure Requirements
By submitting a vulnerability report under this program, the reporter agrees to the following conditions:
- No Public Disclosure: The reporter must not publicly disclose, discuss, or reference the vulnerability, Lineaje, or any Lineaje product or service without explicit prior written consent from Lineaje.
- No Attribution to Lineaje: Any public communication, research publication, presentation, blog post, social media post, or advisory must not name, reference, or otherwise identify Lineaje, its brand, products, services, customers, or proprietary technology.
- Anonymized Disclosure Only: If disclosure is permitted by Lineaje, it must be fully anonymized and framed generically (e.g., “a SaaS provider” or “a software vendor”) with no details that could reasonably identify Lineaje.
- No Use of Logos or Trademarks: Lineaje’s name, logo, trademarks, product or service names may not be used in any announcement or publication.
- Approval Required: Any exception to these requirements must be approved in advance and in writing by Lineaje.
Failure to comply with these conditions may result in exclusion from this program and potential legal action.
Reporter Anonymity
- Reporters may submit vulnerabilities anonymously.
- Lineaje will not disclose reporter identities without explicit consent, except where required by law.
- If the reporter chooses to remain anonymous, all communications and acknowledgments will respect that preference.
Coordination with Third Parties
For vulnerabilities involving third-party components or services, Lineaje will coordinate remediation efforts with the appropriate vendors. Any external disclosure will remain subject to the confidentiality and anonymity requirements defined in this program.
Handling Vulnerability Reports
Acknowledgment & Investigation
- Acknowledgment: Lineaje aims to acknowledge receipt of reports within 72 hours.
- Investigation: Our security team will investigate promptly and may request additional information through secure channels.
Patch Development & Remediation
- Fix Development: Confirmed vulnerabilities will be remediated according to risk and impact.
- Deployment: Fixes will be released through standard update mechanisms.
Safe Harbor
Researchers acting in good faith and in accordance with this VDP—including confidentiality and anonymity requirements—will not be subject to legal action by Lineaje for their research activities.
Legal Considerations
This program is designed to comply with applicable laws and regulations. Lineaje reserves all legal rights in the event of policy violations.
Communication & Transparency
- Lineaje will communicate status updates directly to the reporter when possible.
- Any public statements regarding vulnerabilities will be issued solely by Lineaje at its discretion.
Conclusion
Lineaje values the security research community and appreciates responsible vulnerability reporting. Adherence to this program ensures vulnerabilities are addressed effectively while protecting Lineaje, its customers, and the broader ecosystem.
Contact
For questions regarding this program, contact:
