We Take Security Seriously. So Should You.
Security isn’t a marketing checkbox at LittleBig.Co – it’s a fundamental requirement. Our plugins handle your business data, and we’re accountable for keeping that data protected.
If you’ve found a security vulnerability in any of our plugins, we want to know about it. Not next week. Now.
How to Report Security Vulnerabilities
We participate in the Patchstack Managed Vulnerability Disclosure Program (mVDP). This means:
• Your reports go to security professionals who verify them
• Valid vulnerabilities get CVE assignments
• We respond within 48 hours
• Patches are validated before release
• Everything is handled confidentially until fixed
All security reports should be submitted through Patchstack’s platform, not through regular support channels.
Our Plugins & Reporting Links
edoo.sys Data Connector
• Report vulnerabilities: Patchstack
More plugins will be added to this program as they’re released.
What Happens After You Report
1. Validation – Patchstack triages your report within 24-72 hours
2. Notification – Valid vulnerabilities are forwarded to us immediately
3. Response – We acknowledge receipt within 48 hours
4. Patch Development – We develop and test a fix
5. Validation – Patchstack validates our patch
6. Release – Security update released to all users
7. Disclosure – After users have time to update, the vulnerability is publicly disclosed
Our Commitments
• 48-hour response time to validated vulnerability reports
• Separate security updates from feature releases
• Clear communication throughout the process
• No legal action against researchers reporting in good faith
• Credit for researchers who discover vulnerabilities (if desired)
• 10-year support for security updates on active products
What We Don’t Accept
• Vulnerabilities in outdated/unsupported versions
• Social engineering attacks against LittleBig.Co or our customers
• Physical attacks against our infrastructure
• Denial of service (DoS) attacks
• Spam or automated testing that impacts service
Compliance
This vulnerability disclosure program helps us comply with the EU Cyber Resilience Act (CRA) requirements for commercial software. We report confirmed vulnerabilities to the EU vulnerability database (ENISA) as required by law.
Questions?
For general security questions (not vulnerability reports): [email protected]
For vulnerability reports: Use the Patchstack links above. Do not send vulnerability details via regular email.