How to report
By e-mail to security@legacymind.de or info@legacymind.de, in German or English. Please include the affected URL or function, the steps to reproduce, what an attacker gains, and how we can reach you. A short text is enough.
What is in scope
- the website www.legacymind.de
- the app app.legacymind.de with login, upload, results and reports
- the Firmware Extractor (beta)
Out of scope: load and stress tests, social engineering against us or our customers, attacks on offices and devices, and the systems of our service providers. Please report a vulnerability at a service provider to that provider. If it affects our customers' data, write to us as well.
A wrong or missing finding in an analysis report goes to info@legacymind.de.
Rules for your testing
- Test with your own account. Do not access, change or delete other users' data.
- If you reach someone else's data, stop at that point and report the finding. Do not pass on what you saw, and delete it after the report.
- Only upload firmware you are allowed to upload.
- No malware, no backdoors, no lasting changes to our systems.
- Publish only once the vulnerability is fixed or we have agreed a date with you.
Our commitment
If you follow these rules and act in good faith, we take no legal action against you: no cease-and-desist letter, no lawsuit, no criminal complaint. If a third party accuses you because of your testing, we confirm on request that it followed these rules.
If a rule is unclear for your case, ask first at security@legacymind.de.
What happens after your report
- Within five working days you get a first answer and, where already possible, our assessment.
- While we fix the vulnerability, we keep you informed.
- We agree the publication date with you. On request we name you as the finder.
We do not pay bounties.
This address is machine-readable in our security.txt. How we handle your firmware is described under Security and confidentiality.