Ladder Responsible Disclosure Policy
Overview
Security is a top priority at Ladder, and keeping our users' data safe is a core company value. While we strive for perfection, we recognize that working with skilled security researchers worldwide is essential to identifying and resolving vulnerabilities. This policy defines how to report vulnerabilities and how Ladder evaluates and remediates findings.
Reporting a Vulnerability
If you believe you have found a security issue in our products or services, please notify us at security@ladderlife.com. To help us triage your report quickly, please include:
- A clear description of the issue and its potential impact.
- The affected system, URL, or endpoint.
- Step-by-step reproduction instructions.
- Supporting evidence such as logs, screenshots, or code snippets.
- For web requests, please add the header X-Ladder-Researcher: [your_name/email] to help us identify your testing traffic.
Scope
This policy applies to systems owned or operated by Ladder, including public web applications and APIs. Exclusions: This policy does not apply to third-party services not controlled by Ladder, denial of service (DoS) testing, social engineering, physical security testing, or any activity that degrades service availability.
Rules of Engagement
To qualify for "Safe Harbor," we ask that you conduct your research in good faith:
- Do no harm: Use non-destructive testing and only interact with accounts you own.
- Stop immediately: If you confirm a vulnerability or encounter sensitive data, stop testing and report it without delay. Do not retain, modify, or exfiltrate any data.
- No Automated Scans: Please refrain from automated scanning without prior coordination so we can distinguish your traffic from legitimate threats.
- Confidentiality: Do not publicly disclose the vulnerability until Ladder confirms remediation or 90 days have passed since our acknowledgment.
Safe Harbor
Ladder will not pursue legal action against researchers who follow this policy, act in good faith, and avoid harm to our systems, data, or users. Activity outside these guidelines may result in legal action.
Response & Rewards
We aim to be a responsive partner in your research:
- Acknowledgement: We will acknowledge receipt of your report within 48 hours.
- Triage: We perform initial triage within 3 to 5 business days.
- Remediation: We prioritize fixes based on risk (CVSS), targeting 7 days for Critical and 30 days for High-severity issues.
Recognition and Rewards: While Ladder does not operate a formal, guaranteed bug bounty program, we may provide rewards at our discretion for high-quality, impactful reports. Each report and corresponding reward is considered on a case-by-case basis. Typical rewards are based on the assessed severity of the reported vulnerability.