MeshLogic Pty Ltd supports good-faith security research. This page describes how to report a vulnerability, what to expect from us, and the legal Safe Harbor we extend to researchers. This page is regularly updated from our internal vulnerability management process.
1. HOW TO REPORT A VULNERABILITY
Preferred channels, in order:
- GitHub Security Advisory at the affected repository's
Securitytab → "Report a vulnerability". Private to MeshLogic maintainers and the reporter until published. Best option for findings scoped to a single repository. Note: MeshLogic source repositories are private; researchers without repo access can still submit a private advisory provided the repository has Private Vulnerability Reporting enabled. If the Security tab does not show a "Report a vulnerability" button, please use channel 2 or 3 below. - Email:
security@meshlogic.ai. Monitored by MeshLogic Security. PGP encryption pending (key fingerprint and download published at the URL referenced from/.well-known/security.txtEncryptionfield when active). - Website contact form at
meshlogic.ai/contact. An HTTPS-form alternative if your organisation's outbound email is blocked or unreliable. Please include the word "security" in the subject so we can route your message correctly.
What to include in your report:
- A description of the issue
- Affected products and version(s) if known
- Reproduction steps (or proof-of-concept)
- Your CVSS v3.1 base score estimate, if known
- Whether you would like to be publicly credited in the advisory
2. SEVERITY CLASSIFICATION (CVSS v3.1)
MeshLogic uses CVSS v3.1 base scores to triage every confirmed vulnerability:
| Severity | CVSS base score | Examples |
|---|---|---|
| P0 / Critical | 9.0 – 10.0 | Unauthenticated remote code execution; authentication bypass; cross-tenant data exfiltration; compromise of signing keys; malicious supply-chain dependency |
| P1 / High | 7.0 – 8.9 | Authenticated privilege escalation across tenants; sensitive data leak (PII, credentials); JWT-trust forgery on write routes; bypass of compliance-evidence signing |
| P2 / Medium | 4.0 – 6.9 | Same-tenant information disclosure; denial-of-service amplification; missing rate limit; unsanitised user input in logs |
| P3 / Low | 0.1 – 3.9 | Self-XSS requiring user interaction; verbose error messages; missing security headers; outdated dependencies with no known exploit path |
3. RESPONSE TIMELINE
| Severity | Acknowledge | Triage complete | Fix deployed to production |
|---|---|---|---|
| P0 / Critical | 24 hours | 48 hours | 7 days |
| P1 / High | 72 hours | 7 days | 30 days |
| P2 / Medium | 7 days | 14 days | 90 days |
| P3 / Low | 14 days | 30 days | 180 days |
These SLAs are enforced via internal automation. The "acknowledge" clock starts when your report arrives at security@meshlogic.ai or as a GitHub Security Advisory submission.
4. DISCLOSURE TIMELINE
MeshLogic adopts the Google Project Zero 90-day default for coordinated disclosure:
- Day 0 — Report received and acknowledged within the SLA above
- Day 0 – 7 — Triage; severity assigned; owner assigned
- Day 0 – 30 — Fix developed and tested
- Day 30 – 90 — Coordinated disclosure window; patch deployed; advisory drafted
- Day 90 — Advisory published; CVE assigned (if applicable); affected customers notified
- Extension — Up to 14 additional days may be granted in writing for genuinely complex fixes
For findings affecting multiple vendors, MeshLogic coordinates with affected parties and respects the longest embargo period mutually agreed.
5. SAFE HARBOR
MeshLogic will not pursue legal action, file law-enforcement complaints, or take other adverse action against researchers who:
- Make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of services
- Only access the minimum data necessary to demonstrate the vulnerability
- Provide MeshLogic reasonable time to address the issue before public disclosure (default: 90 days per Section 4)
- Do not exploit the vulnerability beyond what is necessary to confirm it exists
- Do not engage in extortion or threats
This Safe Harbor does not authorise:
- Testing against MeshLogic customer production tenants without that customer's explicit written authorisation
- Denial-of-service testing
- Spam, social engineering, or phishing against MeshLogic personnel
- Physical attacks on MeshLogic facilities or personnel
If your research falls outside Safe Harbor, contact security@meshlogic.ai before the activity to discuss scope authorisation. Our policy is derived from the Atlassian Security Disclosure Policy and is provided in the spirit of #legalbugbounty.
6. OUT OF SCOPE
- Denial-of-service testing against any MeshLogic-operated service
- Social engineering of MeshLogic personnel
- Physical attacks against MeshLogic facilities or personnel
- Issues in third-party SaaS we use but do not operate (Vanta, Sentry, etc. — report directly to that vendor)
- Issues in customer-controlled tenants without that customer's explicit written authorisation
7. RECOGNITION
Researchers acting in good faith are publicly acknowledged in the published advisory (with permission) and on this page once the Hall of Fame launches. MeshLogic does not currently offer a monetary bug bounty; this is under consideration once we reach a minimum of three paying customers, after which we will operate a triage-only bug bounty tier via a major coordinating platform (HackerOne, Bugcrowd, or Intigriti).
8. CONTACT
To report a vulnerability, contact us using these details:
Email: security@meshlogic.ai
Disclosure metadata: /.well-known/security.txt (RFC 9116)
Time-sensitive? Email security@meshlogic.ai directly. It is the canonical channel for vulnerability disclosure; reports sent through the general Contact page may be delayed.