We Take Security Seriously. So Should You.
Security isn’t a marketing checkbox at LittleBig.Co – it’s a fundamental requirement. Our plugins handle your business data, and we’re accountable for keeping that data protected.
If you’ve found a security vulnerability in any of our plugins, we want to know about it. Not next week. Now.
How to Report Security Vulnerabilities
Send your report to [email protected]. Please include the plugin name and version, a description of the issue, steps to reproduce it, and the impact you expect. A proof of concept helps, but is not required.
We are in the process of joining the Patchstack Managed Vulnerability Disclosure Program. Until that program is active, [email protected] is the only reporting channel. Once it is live, this page will link to it and the email address will remain as a fallback.
What you can expect:
- We acknowledge your report within 48 hours.
- We keep your report confidential until a fix is released.
- We tell you when a fix is available and credit you if you wish.
Our Plugins & Reporting Links
edoo.sys Data Connector
More plugins will be added to this program as they’re released.
What Happens After You Report
- Notification – Valid vulnerabilities are forwarded to us immediately
- Response – We acknowledge receipt within 48 hours
- Patch Development – We develop and test a fix
- Release – Security update released to all users
- Disclosure – After users have time to update, the vulnerability is publicly disclosed
Our Commitments
• 48-hour response time to validated vulnerability reports
• Separate security updates from feature releases
• Clear communication throughout the process
• No legal action against researchers reporting in good faith
• Credit for researchers who discover vulnerabilities (if desired)
• 10-year support for security updates on active products
What We Don’t Accept
• Vulnerabilities in outdated/unsupported versions
• Social engineering attacks against LittleBig.Co or our customers
• Physical attacks against our infrastructure
• Denial of service (DoS) attacks
• Spam or automated testing that impacts service
Compliance
This vulnerability disclosure program helps us comply with the EU Cyber Resilience Act (CRA) requirements for commercial software. We report confirmed vulnerabilities to the EU vulnerability database (ENISA) as required by law.
Questions?
Vulnerability reports and general security questions both go to [email protected]. Please do not publish details of a vulnerability before we have released a fix and our customers have had time to update.