Skip to content
LogosPilot
Start free trial

Responsible disclosure

If you have found a security issue in LogosPilot, we want to hear about it directly. No account, nothing to sign, and no legal threat.

How to report

Email security@logospilot.com. That is the whole process.

There is nothing to sign and no account to create

You do not need to agree to terms before we will read your report, and you do not need to register to send it.

Useful to include, though none of it is required: what you found, how to reproduce it, the LogosPilot version, and the environment you saw it in.

What happens next

Our commitments to you
StageWhat we do
AcknowledgeWe confirm we have it and that it is being looked at
AssessWe attempt to reproduce it and determine scope and severity
Tell you the outcomeIncluding if we conclude it is not a vulnerability, and why
FixWe resolve it and confirm to you when it is done
CreditWe offer public credit. Whether to take it is your decision

No legal action against good-faith research

We will not pursue legal action against anyone reporting a genuine issue in good faith. A vulnerability report is a favor from a stranger, and we intend to treat it that way.

Scope

In scope: the LogosPilot desktop application, the installer and its signing, the licensing service, and this website.

An integrity failure belongs here. If a checksum does not match after a second download, or a digital signature reports as invalid rather than merely unknown, send it to security rather than support.

Not in scope for this address: a product defect that is not security-relevant. Those go to support@logospilot.com, and we will move it if we disagree — you will not be sent back and forth.

Third-party findings

Where a security-relevant property belongs to software we integrate with rather than to LogosPilot, we publish it anyway.

Example, published on our own pages

vMix exposes two unauthenticated control surfaces — TCP 8099 and a web controller on 8088. Anything that can reach the host can drive the switcher. That is how vMix works and not something we introduce, but it changes how you should deploy, so we state it on System requirements and Integrations.

Where to go next

Related

Report a security issue

Tell us what you found. Reporting something that turns out to be nothing costs you a short email and costs us nothing — we would rather hear it.

Email security Verify a download