Security & Vulnerability Disclosure Policy

Our Commitment

At LED Architect Pro™, we take the security of our platform, our customers, and their data seriously. We appreciate the efforts of security researchers and members of the security community who responsibly identify and report potential vulnerabilities.

This policy explains how to report security issues and how we will respond.

Responsible Disclosure

If you discover a potential security vulnerability affecting LED Architect Pro™, we ask that you report it responsibly so that we can investigate and resolve the issue before public disclosure.

Please include as much information as possible, including:

• Description of the vulnerability
• Steps required to reproduce the issue
• Expected behavior
• Actual behavior
• Screenshots, videos, or proof-of-concept code when appropriate
• Browser, operating system, and device information
• Any logs that may assist in reproducing the issue

Reports should provide sufficient detail to allow our engineering team to reproduce the issue.

How to Report a Vulnerability

Security reports may be submitted by email to: security@ledarchitectpro.com

Please include the subject line: Security Vulnerability Report

If you believe the issue presents an immediate or critical risk, please indicate Critical Severity in the subject line.

Our Commitment to Researchers

When acting in good faith and in accordance with this policy, we will make reasonable efforts to:

• Acknowledge receipt of your report.
• Investigate the reported issue.
• Keep you informed regarding the status of our investigation.
• Work to resolve confirmed vulnerabilities in a timely manner.
• Credit you for your discovery when appropriate and with your permission.

Response Timeline

Although every issue is different, our general goals are:

Stage	Target Time
Acknowledge report	Within 3 business days
Initial review	Within 7 business days
Severity assessment	As soon as practical
Resolution	Based on complexity and severity
Public disclosure	After remediation, when appropriate

These timeframes are goals rather than guarantees.

Scope

Examples of issues that may be in scope include:

• Authentication bypass
• Authorization flaws
• Privilege escalation
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)
• SQL injection
• Remote code execution
• Command injection
• Insecure direct object references (IDOR)
• Server-side request forgery (SSRF)
• Sensitive information disclosure
• Session management vulnerabilities
• Cryptographic weaknesses
• Security configuration errors
• API vulnerabilities
• Business logic flaws with security impact

Out of Scope

The following generally fall outside this policy:

• Spam reports
• Social engineering attacks
• Phishing simulations
• Denial-of-service testing
• Physical security issues
• Reports requiring unrealistic user interaction
• Missing security headers without demonstrable impact
• Clickjacking without meaningful exploitation
• Self-XSS
• Reports involving unsupported browsers or obsolete software
• Automated scanner output without demonstrated impact
• Duplicate reports already under investigation

Rules of Engagement

When testing our systems, please:

• Act in good faith.
• Avoid harming customers or disrupting service.
• Test only the minimum necessary to demonstrate the vulnerability.
• Do not access, modify, or delete customer data.
• Do not attempt to escalate privileges beyond what is required to demonstrate the issue.
• Do not introduce malware or persistent code.
• Do not publicly disclose vulnerabilities until they have been remediated or we have agreed on coordinated disclosure.

Safe Harbor

We will not pursue legal action against researchers who:

• Act in good faith.
• Follow this policy.
• Avoid intentionally accessing customer information.
• Avoid service disruption.
• Promptly report discovered vulnerabilities.

Activities that violate applicable laws or intentionally harm users or our systems are not protected by this policy.

Bug Bounty

LED Architect Pro™ does not currently operate a public bug bounty program.

We sincerely appreciate responsible disclosure from the security community. While financial rewards are not guaranteed, we may choose to recognize exceptional contributions at our sole discretion.

Data Protection

Any information submitted as part of a vulnerability report will be used solely for investigating and resolving the reported issue.

Reporter contact information will be handled in accordance with our Privacy Policy.

Third-Party Services

LED Architect Pro™ relies on trusted third-party providers, including cloud hosting, authentication, payment processing, analytics, and infrastructure services.

If a reported vulnerability affects a third-party provider rather than LED Architect Pro™ directly, we may coordinate with the provider or ask that the issue be reported through that provider's official disclosure process.

Policy Updates

We may revise this Security & Vulnerability Disclosure Policy at any time. Updates become effective upon publication on our website.

Continued use of LED Architect Pro™ constitutes acceptance of the revised policy.

Thank you for helping us keep LED Architect Pro™ secure for everyone.