# Coordinated Vulnerability Disclosure Policy | Logmanager { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Logmanager", "item": "https://logmanager.com/" }, { "@type": "ListItem", "position": 2, "name": "Security Center", "item": "https://logmanager.com/security/" }, { "@type": "ListItem", "position": 3, "name": "Coordinated Vulnerability Disclosure Policy", "item": "https://logmanager.com/security/coordinated-vulnerability-disclosure-policy/" } ] } :root { --lm-bg: #F4F6F9; --lm-card-bg: #FFFFFF; --lm-text-main: #0B192C; --lm-text-muted: #64748B; --lm-border: #E2E8F0; --lm-primary: #1B52E8; --lm-teal: #00635A; --lm-teal-bg: #E6F4F1; --lm-teal-border: #A3D9CF; --lm-badge-bg: #EAF0FC; --lm-badge-text: #1B52E8; --lm-radius: 12px; } .lm-policy-wrapper { background-color: var(--lm-bg); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; color: var(--lm-text-main); line-height: 1.6; padding: 40px 20px; } .lm-container { max-width: 860px; margin: 0 auto; } .lm-header { margin-bottom: 28px; } .lm-brand-line { display: flex; align-items: center; gap: 8px; font-weight: 600; font-size: 14px; color: var(--lm-text-muted); margin-bottom: 16px; } .lm-brand-line a { color: var(--lm-text-muted); text-decoration: none; } .lm-brand-line a:hover { color: var(--lm-primary); } .lm-brand-logo { font-weight: 800; font-size: 18px; color: var(--lm-text-main) !important; letter-spacing: -0.5px; } .lm-title { font-size: 34px; font-weight: 800; color: var(--lm-text-main); margin: 0 0 12px 0; display: flex; align-items: center; gap: 10px; letter-spacing: -0.5px; } .lm-title::before { content: "//"; color: var(--lm-teal); } .lm-meta-bar { display: flex; flex-wrap: wrap; align-items: center; gap: 16px; font-size: 13px; color: var(--lm-text-muted); margin-bottom: 24px; border-bottom: 1px solid var(--lm-border); padding-bottom: 16px; } .lm-meta-item { display: flex; align-items: center; gap: 6px; } .lm-meta-badge { background: var(--lm-teal-bg); color: var(--lm-teal); border: 1px solid var(--lm-teal-border); padding: 2px 8px; border-radius: 4px; font-weight: 600; font-size: 12px; } .lm-hero-callout { background: var(--lm-card-bg); border: 1px solid var(--lm-border); border-left: 4px solid var(--lm-teal); border-radius: var(--lm-radius); padding: 24px; margin-bottom: 32px; box-shadow: 0 4px 12px rgba(0, 0, 0, 0.02); } .lm-hero-callout h3 { margin: 0 0 8px 0; font-size: 16px; color: var(--lm-text-main); font-weight: 700; } .lm-hero-callout p { margin: 0; font-size: 14px; color: var(--lm-text-muted); } .lm-card { background: var(--lm-card-bg); border-radius: var(--lm-radius); border: 1px solid var(--lm-border); padding: 40px; box-shadow: 0 4px 12px rgba(0, 0, 0, 0.03); } .lm-policy-section { margin-bottom: 36px; } .lm-policy-section:last-child { margin-bottom: 0; } .lm-section-num { display: inline-block; background: var(--lm-badge-bg); color: var(--lm-badge-text); font-weight: 700; font-size: 12px; padding: 2px 8px; border-radius: 6px; margin-bottom: 8px; } .lm-policy-section h2 { font-size: 20px; font-weight: 700; color: var(--lm-text-main); margin: 0 0 16px 0; } .lm-policy-section p { margin: 0 0 16px 0; font-size: 15px; color: #334155; } .lm-policy-section ul, .lm-policy-section ol { margin: 0 0 16px 0; padding-left: 20px; color: #334155; font-size: 15px; } .lm-policy-section li { margin-bottom: 8px; } .lm-safe-harbor { background: #F8FAFC; border: 1px solid var(--lm-border); border-radius: 8px; padding: 20px; margin: 20px 0; } .lm-safe-harbor h4 { margin: 0 0 8px 0; font-size: 15px; color: var(--lm-primary); font-weight: 700; } .lm-key-block { background: #0B192C; color: #E2E8F0; padding: 16px 20px; border-radius: 8px; font-family: ui-monospace, SFMono-Regular, Consolas, monospace; font-size: 13px; overflow-x: auto; margin: 16px 0; line-height: 1.8; } .lm-key-block a { color: #60A5FA; text-decoration: underline; } .lm-key-block span { color: #94A3B8; } .lm-cra-box { background: #FFFBEB; border: 1px solid #FCD34D; border-left: 4px solid #D97706; border-radius: 8px; padding: 18px 20px; margin: 20px 0; font-size: 14px; color: #78350F; } .lm-cra-box strong { color: #92400E; } .lm-cta-box { background: var(--lm-bg); border: 1px dashed var(--lm-border); border-radius: 10px; padding: 24px; text-align: center; margin-top: 40px; } .lm-btn-primary { display: inline-block; background: var(--lm-teal); color: #FFFFFF; text-decoration: none; padding: 10px 20px; font-size: 14px; font-weight: 600; border-radius: 8px; margin-top: 12px; transition: background 0.2s; } .lm-btn-primary:hover { background: #004D46; } @media (max-width: 600px) { .lm-card { padding: 24px 18px; } } [Logmanager](https://logmanager.com/) / [Security Center](https://logmanager.com/security/) / Disclosure Policy # Coordinated Vulnerability Disclosure Policy Version: **1.0** Effective Date: **September 1st, 2026** CRA Article 14 Compliant Maintained by: **Logmanager PSIRT** ### Commitment to Security & Operational Integrity At Logmanager, security is fundamental to everything we build. We value the security community and independent researchers who help keep our products, infrastructure, and customers safe. This policy outlines our guidelines for discovering, reporting, and disclosing security vulnerabilities responsibly. 01## Scope & Applicability This policy applies to all hardware, software, cloud services, and digital assets owned or managed by Logmanager, including but not limited to: - **Logmanager Appliance** (Versions 3.x and 4.x firmware) - **Logmanager Forwarder & Logproxy** components - **Logmanager Windows Agent** - **Logmanager Official Web Properties** (\*.logmanager.com, \*.logmanager.io) *Out of Scope:* Third-party services, applications integrated via customer APIs, physical office infrastructure, and social engineering attacks aimed at Logmanager employees. 02## Safe Harbor & Researcher Conduct When conducting security research in good faith and in accordance with this policy, Logmanager considers your activities authorized. We will not take legal action or initiate law enforcement complaints against researchers who adhere to the following principles: #### Golden Rules of Engagement - **Do no harm:** Avoid testing against production customer systems or degrading service performance. - **Privacy protection:** Never access, modify, download, or disclose customer data. If customer data is accidentally accessed, purge it immediately and notify PSIRT. - **No destructive testing:** DoS, DDoS, high-frequency brute forcing, and physical exploitation are strictly prohibited. - **Confidentiality:** Keep vulnerability details confidential until a fix is released and public disclosure is coordinated. 03## Reporting Process & Response SLA If you suspect you have identified a vulnerability, please submit your findings through our secure portal or email our Product Security Incident Response Team (PSIRT). Primary Submission Portal: PGP / Encrypted Email: psirt@logmanager.com PGP Key ID: 0xA1B2C3D4 (Fingerprint: 8F2A 9C10 E451 …) Upon receiving a vulnerability report, the Logmanager PSIRT team commits to the following timelines: 1. **Acknowledgement:** Within **24 business hours** of report submission. 2. **Initial Assessment & Triage:** Within **3 business days**, confirming severity (CVSS v3.1/v4.0) and applicability. 3. **Status Updates:** Regular updates provided at least every **10 business days** until remediation. 04## Cyber Resilience Act (CRA) & Regulatory Reporting **Regulatory Notice (EU Cyber Resilience Act):** If a reported vulnerability is determined to be **actively exploited in the wild**, Logmanager is legally mandated under EU CRA Article 14 to notify the European Union Agency for Cybersecurity (ENISA) and competent national CSIRTs within **24 hours** of becoming aware. Please clearly highlight in your initial report if you have evidence or reasonable suspicion of active exploitation in customer or production environments. 05## Remediation & Disclosure Timeline Logmanager operates under a standard **90-day coordinated disclosure timeline**: - **Standard Vulnerabilities:** Fixes are issued within 90 days. Public security advisories and CVE publication take place upon patch release. - **Critical / Actively Exploited Issues:** Accelerated remediation workflows are triggered immediately. Emergency patches or mitigations are targeted within 7 to 14 days. We believe in full credit for researchers. If desired, your name or alias will be recognized in our Security Advisory Release Notes and Hall of Fame. ### Ready to submit a security finding? Use our secure encrypted vulnerability submission form to submit step-by-step reproduction details. [Go to Vulnerability Report Form →](https://logmanager.com/security/vulnerability-report/)