Skip to content

Vulnerability Disclosure

Indian Hill Labs welcomes good-faith reports that help protect users and improve products. This page publishes the handling rules and the current readiness boundary for external security reports.

Reporting channel not yet active — reviewed 2026-08-30

Indian Hill Labs has not published an approved security-reporting address, encryption key, or intake endpoint. Do not send sensitive vulnerability details to a guessed email address, ordinary contact form, or public issue tracker. This page will identify the exact channel and its protection method before a generally available product relies on external vulnerability intake.

Activation requirements

Before public artifact availability, Indian Hill Labs will publish:

  • an approved reporting endpoint under an Indian Hill Labs-controlled domain;
  • the data-protection method for sensitive reports;
  • supported product and service scope;
  • acknowledgement and status-update targets; and
  • any safe-harbor terms that have completed legal review.

Include in a report

When the reporting channel is activated, provide:

  • affected product, version, and artifact digest;
  • vulnerability description and likely impact;
  • reproducible steps or a minimal proof of concept;
  • required configuration or privileges;
  • relevant logs with credentials and personal data removed;
  • whether active exploitation is known or suspected; and
  • a safe way to contact the reporter.

Good-faith handling principles

Reporters should avoid privacy violations, service disruption, data destruction, persistence, social engineering, and access beyond what is necessary to demonstrate the issue. Do not publish secrets or exploit details that would create unnecessary harm.

Indian Hill Labs will triage actionable reports, investigate them, coordinate remediation and disclosure where appropriate, and credit reporters who request recognition and follow the published policy. Response targets take effect only when they appear with the activated reporting channel; they are not contractual service levels unless separately agreed in writing.

For already published vulnerability information, see Vulnerability Management.