Skip to content
Edictum Labs, home
Coordinated disclosure

Report a vulnerability.

If you have found a security issue — in our own systems or in software our research touches — we want to hear about it, and we will handle it in good faith.

Email the security contact
Contact
security@edictum.ai
Acknowledge
Within 3 business days
Our commitment

Good-faith research is welcome here.

We will not pursue or support legal action against researchers who report issues in good faith and follow this policy.

We treat vulnerability reports seriously and respectfully. If you act in good faith, respect the guidelines below, and give us a reasonable chance to remediate, you will find us a cooperative counterpart — not an adversarial one.

This policy describes our intent and process. It is not a contract and does not grant authorization to test third-party systems.

How to report

Send it to the security contact.

Email security@edictum.ai. If the issue is sensitive and you need an encrypted channel, say so in your first message and we will arrange one before you share any detail.

Helpful to include

  • A clear description of the issue and its impact
  • Steps or a proof-of-concept that reproduce it
  • The affected component, version, or endpoint
  • Any constraints or disclosure deadline you are working to
What to expect

How we handle your report.

01

Acknowledge

We aim to acknowledge your report within three business days and confirm we are looking into it.
02

Triage

We validate the issue, assess its severity and impact, and may come back with clarifying questions.
03

Remediate

We work toward a fix and, where the issue affects third-party software, coordinate with the relevant vendors.
04

Disclose

We agree a disclosure timeline with you. Public details are published only after a fix is available, with credit where you want it.
Good-faith guidelines

Research responsibly.

These keep disclosure safe for everyone — reporters, users, and the systems involved.
  • Give us a reasonable window to respond before any public disclosure
  • Avoid privacy violations, data destruction, and service disruption
  • Only access accounts or data you own or are authorized to use
  • Do not run intrusive automated scanning that degrades service
Recognition

Credit where you want it.

We are glad to acknowledge the researchers who help us, publicly or not — entirely your call.

Edictum Labs does not currently run a paid bug-bounty program. What we offer is a serious, respectful process and public credit on any resulting advisory, with your consent.

Report an issue