If you find a security problem in a website or service that IG Digital Lab runs, email [email protected]. A person reads that address. We run no paid bug bounty, but we triage every report and we credit you if you want.

IG Digital Lab is the trade name of IGGO, LLC, 3550 Watt Ave, Suite 408, Sacramento, CA 95821. This page covers systems that IGGO, LLC owns and operates. The machine-readable version is at /.well-known/security.txt (RFC 9116).

How to report

Write to [email protected] in English or Russian. Please include:

The URL or hostname affected.
The steps to reproduce it, detailed enough that we can repeat them.
What you saw and what an attacker could do with it.
How to reach you, and whether you want credit.

Do not send other people's personal data. A screenshot with the sensitive parts blacked out is enough. If you need an encrypted channel, say so in your first message and we will arrange one. We do not publish a PGP key today.

What to expect

We confirm receipt within 3 business days (Monday to Friday, Pacific Time).
We send a first assessment within 10 business days: whether we can reproduce it and how severe we think it is.
We aim to fix confirmed vulnerabilities within 90 days, sooner when someone is exploiting them. If a fix needs longer, we tell you why and give a new date.
We tell you when the fix ships.

Please give us 90 days before you publish details. If 90 days pass with no fix and no agreed date, you may publish.

Scope

In scope: igdigi.com, firstreply.igdigi.com, ai.igdigi.com, the applications behind them, the AI receptionist that answers (916) 618-0502, and the code in our public repositories at github.com/igdigitallab. The phone line is our live business line. Prompt-injection findings are welcome by email. Please do not call in bulk or tie the line up while real callers may be trying to get through.

Out of scope:

Services run by other companies, even where a subdomain of ours points to them. pay.igdigi.com, for one, is served by Stripe. Report those problems to the vendor.
Websites we built for clients. They belong to the client. Tell us anyway and we will pass the report on, but the safe harbor below does not cover testing them.
Denial of service, load testing, and anything that degrades the service for other people.
Social engineering of our staff or clients, phishing, and physical access to our premises.
Automated scanner output with no demonstrated impact, self-XSS, version banners, and missing best-practice headers with no attack behind them.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized. We will not take or support legal action against you for it. If a third party takes legal action over the same research, we will say that your work followed this policy. Stop testing and report as soon as you reach personal data, and do not copy, change or delete anyone else's data.

This covers IGGO, LLC's own systems only. It does not bind anyone else, and it cannot authorize breaking a vendor's terms or the law.

Recognition

We do not pay bounties. Once a fix ships, we credit you on this page by name or handle, if you want that.

What you can check without asking us

igdigi.com is served over HTTPS only, with an HSTS header (one year, includeSubDomains).
CAA records limit which certificate authorities may issue certificates for the domain.
Mail we send from igdigi.com is DKIM-signed, and we publish a DMARC record with aggregate reporting turned on.
Inbound mail has an MTA-STS policy in testing mode, with TLS reporting.

Contact

Security reports: [email protected]. Anything else: [email protected].