LogicNodes Legal

Legal documentation and policies

EN | DA

LogicNodes - Responsible Disclosure Policy

Effective Date: November 3, 2025

Last Updated: November 3, 2025

1. Introduction

LogicNodes is committed to protecting the security and privacy of our partners and their users. We welcome and appreciate responsible disclosure of security vulnerabilities from the security research community.

This policy provides guidelines for security researchers to report vulnerabilities responsibly and outlines how LogicNodes will respond.

2. Scope

2.1 In-Scope Systems

Security researchers are authorized to test the following systems:

Production Environment:

Testing Environment:

2.2 Out-of-Scope Systems

The following are NOT authorized for testing:

3. In-Scope Vulnerabilities

We are interested in reports of the following vulnerability types:

3.1 Critical Severity

Examples:

3.2 High Severity

Examples:

3.3 Medium Severity

Examples:

3.4 Low Severity

Note: Low severity issues are still valuable reports and will be addressed.

4. Out-of-Scope Vulnerabilities

The following are NOT eligible for acknowledgment or rewards:

4.1 Excluded Vulnerability Types

4.2 Known Issues

The following are known and will not be addressed immediately:

5. Responsible Disclosure Guidelines

5.1 Testing Rules

When testing for vulnerabilities, researchers must:

DO:

DON’T:

5.2 Safe Harbor

LogicNodes commits to:

Conditions:

Disclaimer: This safe harbor does not grant permission to violate third-party terms of service (e.g., Supabase, AWS). You are responsible for compliance with all applicable laws and terms.

6. Reporting a Vulnerability

6.1 How to Report

Primary Contact:

6.2 Report Format

Please include the following information:

Required:

  1. Vulnerability Type (e.g., SQL Injection, XSS, Authorization Bypass)
  2. Affected System (URL, API endpoint, component)
  3. Severity Assessment (Critical, High, Medium, Low - your opinion)
  4. Steps to Reproduce (detailed, numbered steps)
  5. Proof of Concept (screenshots, code, HTTP requests)

Optional:

  1. Impact Assessment (what an attacker could achieve)
  2. Suggested Remediation (how to fix the issue)
  3. Your Name/Handle (if you want credit)
  4. Disclosure Timeline (if you have specific requirements)

Example Report:

Subject: [SECURITY] SQL Injection in /api/organizations/{org_id}/runs

Vulnerability Type: SQL Injection
Affected System: POST /api/organizations/{org_id}/runs
Severity: Critical

Steps to Reproduce:
1. Authenticate as organization member (POST /api/v1/embed/auth)
2. Send POST request to /api/organizations/{org_id}/runs with payload:
   {
     "filter": "status = 'completed' OR 1=1 --"
   }
3. Observe that all runs are returned (not just own organization)

Proof of Concept:
[Screenshot showing SQL query in error message]
[curl command to reproduce]

Impact:
Attacker can access all organizations' agent runs, bypassing RLS policies.

Suggested Remediation:
Use parameterized queries instead of string concatenation.

Reporter: John Doe (john@example.com)
Disclosure: 90 days (standard)

6.3 Encrypted Reporting (Optional)

For sensitive vulnerabilities, you may encrypt your report using PGP:

  1. Download PGP key: /en/pgp
  2. Encrypt report with our public key
  3. Send encrypted email to security@logicnodes.ai

Note: PGP is optional. Unencrypted email to security@logicnodes.ai is acceptable.

7. Response Process

7.1 Timeline

Within 24 Hours:

Within 72 Hours:

Within 90 Days:

7.2 Severity Classification

LogicNodes uses the following severity levels:

Critical (P0):

High (P1):

Medium (P2):

Low (P3):

Informational:

7.3 Communication

During Investigation:

After Remediation:

Public Disclosure:

8. Recognition & Rewards

8.1 Public Acknowledgment

Researchers who report valid vulnerabilities will be credited on our Security Hall of Fame (with permission):

URL: https://logicnodes.ai/security/hall-of-fame (coming soon)

Information Published:

Opt-Out: If you prefer to remain anonymous, please indicate in your report.

8.2 Rewards

Current Status: No bug bounty program (planned for 2026)

Future Plans:

Current Recognition:

9. Legal & Compliance

9.1 Safe Harbor (Expanded)

LogicNodes will not initiate legal action against researchers who:

  1. Comply with this policy (testing rules, disclosure timeline)
  2. Make good faith effort to avoid harm (no data theft, DoS, privacy violations)
  3. Report vulnerabilities promptly (within 24 hours of discovery)
  4. Do not publicly disclose (before 90-day embargo or mutual agreement)

What Safe Harbor Covers:

What Safe Harbor Does NOT Cover:

9.2 Disclosure Timeline

Standard Embargo: 90 days from initial report

Early Disclosure (with mutual agreement):

Extended Embargo:

Public Disclosure After 90 Days:

9.3 CVE Assignment

For vulnerabilities meeting CVE criteria:

10. Excluded Parties

The following parties are NOT eligible to participate:

11. Modifications to This Policy

LogicNodes may update this policy at any time. Changes will be posted at: URL: https://logicnodes.ai/security/responsible-disclosure

Notification:

Effective Date:

12. Frequently Asked Questions

12.1 General

Q: Do you have a bug bounty program?
A: Not yet. Planned for Q2 2026 on HackerOne or Bugcrowd. Currently, we offer public acknowledgment and gratitude.

Q: Can I use automated scanners?
A: Please request permission first (security@logicnodes.ai). Automated scanners may trigger rate limits or DoS protections.

Q: Can I test on production systems?
A: Yes, but only on your own accounts. Request test accounts via security@logicnodes.ai for safer testing.

Q: Can I disclose before 90 days?
A: Only with mutual agreement. We prefer coordinated disclosure.

12.2 Scope

Q: Is subdomain takeover in scope?
A: Yes, if you can demonstrate impact (e.g., phishing, cookie theft).

Q: Is rate limiting absence a valid report?
A: Only if it enables DoS or brute force attacks. Missing rate limits alone are informational.

Q: Are third-party dependencies in scope?
A: Yes, if the vulnerability affects LogicNodes (e.g., outdated library with known CVE). Report to us and the vendor.

Q: Is social engineering in scope?
A: No. Do not phish employees, partners, or users.

12.3 Reporting

Q: Can I report anonymously?
A: Yes. Use ProtonMail or Tutanota for anonymous email. We will keep your identity confidential.

Q: Can I report via Twitter/LinkedIn?
A: Please use security@logicnodes.ai for all reports. Social media is not monitored for security reports.

Q: What if my report is a duplicate?
A: We will notify you if the issue was previously reported. Duplicates still receive acknowledgment (but no additional credit).

Q: Can I report issues in third-party services?
A: Report to the third party (Supabase, AWS, Mailgun) directly. If the issue affects LogicNodes’ configuration, report to us as well.

12.4 Rewards

Q: Will I be paid for my report?
A: Not currently (no bug bounty program). You will receive public acknowledgment and our gratitude.

Q: When will bug bounty launch?
A: Estimated Q2 2026, pending revenue milestones.

Q: Can I negotiate a reward?
A: For exceptional findings (0-day, critical severity), contact security@logicnodes.ai to discuss.

13. Contact Information

Security Team

Email: security@logicnodes.ai PGP Key: /en/pgp Response Time: Within 24 hours

General Inquiries

Email: support@logicnodes.ai
Purpose: Non-security questions, product support

Email: legal@logicnodes.ai
Purpose: Safe harbor questions, legal concerns

14. Acknowledgments

LogicNodes thanks the security research community for helping us protect our partners and their users. We are grateful for your responsible disclosure and collaboration.

15. References

Industry Standards:

Disclosure Policies (Inspiration):

Responsible Disclosure Frameworks:

© 2025 LogicNodes ApS. All rights reserved.

LogicNodes ApS Sletvej 2D, 8310 Tranbjerg, Denmark CVR: DK45318362

This Responsible Disclosure Policy is effective November 3, 2025. By submitting a vulnerability report, you agree to the terms of this policy.