Vulnerability Disclosure Policy

Company Sage (The Things We Do PR, LLC) wants to learn about security problems in our websites and services before anyone else does. If you believe you have found a vulnerability, we would like to hear from you. This policy explains what is covered, how to report, what we ask of you, and what you can expect from us.

What this policy covers

This policy applies to the websites and services we own or operate, including companysage.com, wyomingllcattorney.com, llcattorney.com, lonestarllcattorney.com, cindysnewmexicollcs.com, cindysfloridallc.com, our other brand websites, and their customer portals (app. subdomains).

What this policy does not cover

Please do not report the following under this policy:

• Services run by third parties that we use but do not control, such as payment processors, banking and insurance partners, and hosting providers. Report those to the third party under its own policy.
• Findings that require physical access to our offices or devices, social engineering of our staff or customers, or denial of service.
• Output from automated scanners with no demonstrated security impact.
• Missing security headers, software version banners, or similar best-practice notes with no demonstrated impact.
• Clickjacking on pages that have no sensitive actions.

How to report

Email security@companysage.com. Please include the website or service affected, the steps to reproduce the issue, the impact as you understand it, and any proof of concept. Do not include our customers' personal data in your report beyond what is needed to show the issue. Our contact details are also published at https://companysage.com/.well-known/security.txt.

What we ask of you

• Test only against accounts you own or have permission to use.
• Stop and report as soon as you can show the issue. Do not go further to see how much data you can reach.
• Do not access, download, change, or delete data that is not yours. If you come across personal data, stop, do not save it, and tell us.
• Do not run denial-of-service tests, send spam or phishing, attempt to socially engineer our staff or customers, or attack our physical premises.
• Give us a reasonable time to fix the issue before you share it publicly, and coordinate the timing with us. We ask for 90 days from your report.

What you can expect from us

• We will acknowledge your report within 5 business days.
• We will keep you informed as we investigate and fix the issue.
• We will work to fix confirmed issues within a reasonable time based on their severity.
• We will credit you for the finding if you would like us to. We do not currently run a paid bug bounty program.
• We will not take legal action against you for research done in good faith that follows this policy.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized, we will not pursue or support legal action against you for it, and we will work with you to understand and resolve the issue. This policy does not authorize testing of third parties' systems, and it does not override any law. If you are unsure whether something is covered, ask us at security@companysage.com before you test.

Changes to this policy

We may update this policy from time to time. The effective date at the top shows the current version.