Coordinated Vulnerability Disclosure

Last updated: 12 November 2026

Reporting

Please email security@lera.link with a concise description, affected URL or component, steps to reproduce, expected impact and evidence sufficient for validation. You may use a pseudonym and provide a secure return-contact method. Do not include sign-in codes, session tokens or copies of other people's personal data in an ordinary email. Requests for an encrypted communication channel can be sent to the same address.

Safe research boundaries

Test only what is necessary to demonstrate the issue, preferably in your own account or a test environment. Stop immediately if you encounter another person's data. Do not exfiltrate, alter, retain or publish third-party data; introduce persistence or malware; attempt physical intrusion, phishing, social engineering, denial of service or destructive testing; or use automated high-volume scanning that affects availability. Avoid third-party services not owned or operated by LeraLink.

Scope and third parties

The intended scope includes LeraLink-operated services on lera.link and subdomains, relevant LeraLink-controlled APIs and infrastructure, and the LeraLink software serving hosted tenant installations. Customer-owned domains may be in scope only as to LeraLink-controlled application components, not independent customer or third-party services. A custom domain does not authorise testing the tenant's other systems. Where unsure, ask before testing.

Handling reports

We aim to acknowledge actionable reports promptly, assess severity and coordinate an appropriate fix and disclosure timeline. An exact response-time or remediation-time SLA is not offered through this public policy. Where helpful, we may request additional details, credit a researcher with their consent or discuss a responsible public disclosure date. No bounty or reward is promised.

Good-faith research

For research carried out in good faith and within this policy, we do not intend to initiate civil action or make a criminal complaint solely on account of the authorised vulnerability research. This does not grant legal immunity, bind third parties or authorities, or authorise unlawful acts. If your activity strays outside scope, stop and contact us. Any personal data inadvertently accessed should be deleted securely, subject to lawful preservation instructions.

Disclosure coordination

Please give us a reasonable opportunity to investigate and remediate before publicly disclosing exploitable details. This policy is informed by Dutch coordinated vulnerability disclosure practice. Contact: security@lera.link. Every LeraLink address, including the addresses of hosted installations, publishes a machine-readable /.well-known/security.txt that names this contact and the languages we read (English and Dutch).