Security & Responsible Disclosure

How we protect your account, and how to report a vulnerability if you find one.

Last updated: May 2026

What we promise

AES-256-GCM encryption at rest

Every uploaded file is encrypted before it touches storage, with a unique key per file derived from a master key that is never stored in the database.

Multi-factor authentication required

We require TOTP-based MFA for every account. Recovery codes are issued at setup and can be regenerated from your security centre.

Tamper-evident audit log

Security-relevant events are written to an append-only audit log with timestamps, IPs, and user agents. You can review your own log from your dashboard.

Real-time staff-access notifications

If a staff member accesses your account, you are notified by email within seconds. Aggregate counts appear on the public transparency page.

For the full picture of what we can and cannot access, what we share, and how we are honest about our limits, see the Transparency & Security Policy.

Reporting a vulnerability

Email security@securelegacydemo.com

We acknowledge every security report within 24 hours and aim to provide a substantive update within 5 business days. Please give us a reasonable window to fix the issue before any public disclosure.

In scope

Authentication, session management, and MFA flows.
Authorisation and access-control bugs (e.g. one user accessing another user's vault, trustee, or contact).
Encryption and key-handling weaknesses in vault storage or release flows.
Server-side vulnerabilities: SSRF, RCE, SQL injection, deserialisation issues.
Client-side vulnerabilities: XSS, CSRF, clickjacking, or sensitive data leakage.
Misconfiguration of security-relevant headers, cookies, or network policies.

Out of scope

Denial-of-service or volumetric attacks against the live service.
Social engineering of our staff, customers, or trustees.
Physical attacks on our offices or contractors.
Findings derived from automated scanners with no demonstrated impact.
Best-practice recommendations without an exploitable security consequence (e.g. missing HTTP headers on static asset CDNs).
Vulnerabilities affecting only outdated browsers we no longer support.

What we ask

Test only against accounts you control. Do not access, modify, or destroy data belonging to other users.
Stop and notify us as soon as you identify a vulnerability — do not exploit further than is necessary to confirm.
Give us a reasonable window (typically 90 days) to ship a fix before any public disclosure.
Do not violate any applicable laws while researching.

What we offer in return

We do not currently run a paid bug-bounty programme. For valid, novel reports we offer public acknowledgement (with your permission) on this page once the issue has been remediated, and we are happy to coordinate disclosure timing and credit.

PGP

If your report contains sensitive information you would prefer to send encrypted, request our PGP key by emailing security@securelegacydemo.com and we will reply with the current key fingerprint.