FedCredIQ Vulnerability Disclosure Policy

Lytix LLC welcomes good-faith security research on FedCredIQ. If you believe you have found a security vulnerability, we want to hear from you. This policy describes what is covered, how to report, and what you can expect from us.

Scope

In scope: the FedCredIQ service at fedcrediq.com and its subdomains.

Out of scope: denial-of-service testing of any kind, social engineering or phishing of Lytix personnel or FedCredIQ users, physical attacks, spam, and third-party services that FedCredIQ depends on but does not operate (report those to the third party).

Rules of engagement

• Make a good-faith effort to avoid privacy violations, data destruction, and service degradation.
• Do not access, modify, or delete data that is not yours. If a vulnerability exposes another user's data or any government data, stop immediately, do not save, copy, or further access it, and report what you observed.
• Do not run high-volume automated scanning that degrades the service.
• Use a test account where possible; never leverage a finding beyond the minimum needed to demonstrate it.

How to report

Email security@lytix.xyz with: a description of the issue and its impact, steps to reproduce (proof of concept welcome), the URL or component affected, and how we can reach you for follow-up. We accept anonymous reports.

What to expect from us

• Acknowledgement within 3 business days.
• An initial assessment within 7 days, and updates as remediation progresses.
• Remediation prioritized by severity, internet reachability, and exploitability, on the timelines FedRAMP prescribes for our certification level.
• Credit for the finding if you would like it, once fixed.

We do not currently operate a paid bug bounty program.

Coordinated disclosure

We ask that you give us a reasonable opportunity to remediate before public disclosure — as a default, the earlier of a deployed fix or 90 days from your report. We are happy to coordinate on timing.

Safe harbor

Security research conducted in good faith and in accordance with this policy is authorized under the Computer Fraud and Abuse Act (and similar state laws), and we waive any claim under the DMCA for circumvention of technological measures where necessary for that research. We will not initiate or support legal action against you for good-faith, policy-compliant research, and if a third party does, we will make it known that your activities were authorized. If you are ever unsure whether your research is covered, ask us first at security@lytix.xyz.