Ladder Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
source: well-known/ladder-security.txt
docs: https://www.ladderlife.com/security
policy:
- https://ladderlife.com/security
contact:
- mailto:security@ladderlife.com
program_type: responsible-disclosure
bug_bounty: false
safe_harbor: true
description: >-
  Ladder publishes an RFC 9116 security.txt at
  https://www.ladderlife.com/.well-known/security.txt whose Policy field points at
  a full responsible-disclosure policy at https://www.ladderlife.com/security. It
  is a coordinated-disclosure program with published response commitments and
  safe-harbor language for good-faith researchers — not a paid bug bounty, and
  not run on HackerOne, Bugcrowd, or Intigriti.
response_commitments:
  acknowledgement: within 48 hours of receipt
  triage: 3-5 business days
  remediation_target:
    critical: 7 days
    high: 30 days
  researcher_confidentiality: 90 days after acknowledgement
rules_of_engagement:
- Non-destructive testing only
- Testing limited to accounts the researcher owns
- No automated scanning without prior coordination
- Cease testing once a vulnerability is confirmed
out_of_scope:
- Third-party services
- Denial-of-service testing
- Social engineering
- Physical security testing
security_txt:
  expires: 'Thu, 31 Mar 2027 10:00:00 -0700'
  canonical: https://www.ladderlife.com/.well-known/security.txt
  preferred_languages: en
evidence:
- source: well-known/ladder-security.txt
  kind: security.txt
- source: https://www.ladderlife.com/security
  kind: responsible-disclosure policy page