MeshLogic Pty Ltd supports good-faith security research. This page describes how to report a vulnerability, what to expect from us, and the legal Safe Harbor we extend to researchers. It is the public mirror of our canonical internal process, maintained at docs/security/vulnerability-management.md in our platform repository. The internal document is the authoritative version; this page is updated within 7 days of any internal change.
1. HOW TO REPORT A VULNERABILITY
Preferred channels, in order:
- GitHub Security Advisory at the affected repository's
Securitytab → "Report a vulnerability". Private to MeshLogic maintainers and the reporter until published. Best option for findings scoped to a single repository. Note: MeshLogic source repositories are private; researchers without repo access can still submit a private advisory provided the repository has Private Vulnerability Reporting enabled. If the Security tab does not show a "Report a vulnerability" button, please use channel 2 or 3 below. - Email:
security@meshlogic.ai. Monitored by MeshLogic Security. PGP encryption supported (key fingerprint and download published at the URL referenced from/.well-known/security.txtEncryptionfield when active). - Website contact form at
meshlogic.ai/contact. An HTTPS-form alternative if your organisation's outbound email is blocked or unreliable. Please include the word "security" in the subject so we can route your message correctly.
What to include in your report:
- A description of the issue
- Affected products and version(s) if known
- Reproduction steps (or proof-of-concept)
- Your CVSS v3.1 base score estimate, if known
- Whether you would like to be publicly credited in the advisory
2. SEVERITY CLASSIFICATION (CVSS v3.1)
MeshLogic uses CVSS v3.1 base scores to triage every confirmed vulnerability:
| Severity | CVSS base score | Examples |
|---|---|---|
| P0 / Critical | 9.0 – 10.0 | Unauthenticated remote code execution; authentication bypass; cross-tenant data exfiltration; compromise of signing keys; malicious supply-chain dependency |
| P1 / High | 7.0 – 8.9 | Authenticated privilege escalation across tenants; sensitive data leak (PII, credentials); JWT-trust forgery on write routes; bypass of compliance-evidence signing |
| P2 / Medium | 4.0 – 6.9 | Same-tenant information disclosure; denial-of-service amplification; missing rate limit; unsanitised user input in logs |
| P3 / Low | 0.1 – 3.9 | Self-XSS requiring user interaction; verbose error messages; missing security headers; outdated dependencies with no known exploit path |
3. RESPONSE TIMELINE
| Severity | Acknowledge | Triage complete | Fix deployed to production |
|---|---|---|---|
| P0 / Critical | 24 hours | 48 hours | 7 days |
| P1 / High | 72 hours | 7 days | 30 days |
| P2 / Medium | 7 days | 14 days | 90 days |
| P3 / Low | 14 days | 30 days | 180 days |
These SLAs are enforced via internal automation. The "acknowledge" clock starts when your report arrives at security@meshlogic.ai or as a GitHub Security Advisory submission.
4. DISCLOSURE TIMELINE
MeshLogic adopts the Google Project Zero 90-day default for coordinated disclosure:
- Day 0 — Report received and acknowledged within the SLA above
- Day 0 – 7 — Triage; severity assigned; owner assigned
- Day 0 – 30 — Fix developed and tested
- Day 30 – 90 — Coordinated disclosure window; patch deployed; advisory drafted
- Day 90 — Advisory published; CVE assigned (if applicable); affected customers notified
- Extension — Up to 14 additional days may be granted in writing for genuinely complex fixes
For findings affecting multiple vendors, MeshLogic coordinates with affected parties and respects the longest embargo period mutually agreed.
5. SAFE HARBOR
MeshLogic will not pursue legal action, file law-enforcement complaints, or take other adverse action against researchers who:
- Make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of services
- Only access the minimum data necessary to demonstrate the vulnerability
- Provide MeshLogic reasonable time to address the issue before public disclosure (default: 90 days per Section 4)
- Do not exploit the vulnerability beyond what is necessary to confirm it exists
- Do not engage in extortion or threats
This Safe Harbor does not authorise:
- Testing against MeshLogic customer production tenants without that customer's explicit written authorisation
- Denial-of-service testing
- Spam, social engineering, or phishing against MeshLogic personnel
- Physical attacks on MeshLogic facilities or personnel
If your research falls outside Safe Harbor, contact security@meshlogic.ai before the activity to discuss scope authorisation. Our policy is derived from the Atlassian Security Disclosure Policy and is provided in the spirit of #legalbugbounty.
6. OUT OF SCOPE
- Denial-of-service testing against any MeshLogic-operated service
- Social engineering of MeshLogic personnel
- Physical attacks against MeshLogic facilities or personnel
- Issues in third-party SaaS we use but do not operate (Vanta, Sentry, etc. — report directly to that vendor)
- Issues in customer-controlled tenants without that customer's explicit written authorisation
7. RECOGNITION
Researchers acting in good faith are publicly acknowledged in the published advisory (with permission) and on this page once the Hall of Fame launches. MeshLogic does not currently offer a monetary bug bounty; this is under consideration once we reach a minimum of three paying customers, after which we will operate a triage-only bug bounty tier via a major coordinating platform (HackerOne, Bugcrowd, or Intigriti).
8. CONTACT
Email: security@meshlogic.ai
Machine-readable disclosure metadata: /.well-known/security.txt (RFC 9116)
Canonical internal process: MeshLogic-Platform-Prod / docs/security/vulnerability-management.md
For general (non-security) enquiries, please use our Contact page. Reports submitted via the general contact form may experience delay; security@meshlogic.ai is the canonical channel for time-sensitive vulnerability disclosure.