LADX
Start free

Security

Security and vulnerability disclosure

Last updated

If you have found a security problem in LADX, we want to hear about it, and we will treat you as someone helping us rather than someone attacking us. This page says how to tell us, what we will do, and the few things we ask in return.

How to report

Email hello@ladx.ai with "Security" at the start of the subject line. Tell us what you found, where, and how to reproduce it. A proof of concept helps; screenshots are fine. If you think the report itself is sensitive, say so and we will agree a safer way to receive the detail.

Our machine-readable contact file is at /.well-known/security.txt.

What we will do

  • Acknowledge your report within three working days.
  • Tell you within ten working days whether we can reproduce it and what we plan to do.
  • Fix serious problems as quickly as we can, normally within 30 days, and keep you updated.
  • Credit you when the fix is published, if you would like that.

We do not run a paid bug bounty.

What is in scope

  • The website and web application at ladx.ai.
  • The LADX desktop application and its licence activation service.

Services we use but do not run, such as our hosting provider, our email provider, OpenRouter and the AI model providers, are out of scope. Report problems in those to the company concerned.

What we ask of you

  • Only access data you need to show the problem, and never data belonging to other users. If you reach someone else's data, stop, and tell us.
  • Do not change or delete data, degrade the service, or run denial of service, spam or social engineering tests.
  • Give us a reasonable time to fix the problem before telling anyone else.

Our promise in return

If you act in good faith and within this policy, we will not take legal action against you or ask the police to investigate you for your research. If someone else brings a complaint about research you did within this policy, we will say that it was authorised.

How we protect your data

Passwords are stored only as bcrypt hashes. AI provider keys are encrypted with AES-256-GCM before they are stored, and are never sent back to the browser. Sign-in sessions are random identifiers in a cookie that scripts cannot read. Sign-in, sign-up and other sensitive actions are rate limited, and every significant action is written to an audit trail. All traffic to ladx.ai is encrypted with TLS. The privacy policy describes where data is held and for how long.