Vulnerability disclosure policy

For security researchers, customers and partners.

Logic Unknown ApS, the manufacturer of AdminExplorer, welcomes reports of security vulnerabilities. This policy is our coordinated vulnerability disclosure policy under the EU Cyber Resilience Act. It is also published in machine-readable form as security.txt (RFC 9116) at https://adminexplorer.io/.well-known/security.txt, https://portal.adminexplorer.io/.well-known/security.txt and https://docs.adminexplorer.io/.well-known/security.txt.

How to report

Mail security@adminexplorer.io or support@adminexplorer.io - both reach the same team - and start the subject with Security. Write in English or Danish. Keep exploit details out of the subject line.

If the vulnerability is in a portal that a partner runs for you, you can also tell your partner, but please mail us as well: we fix the product.

What to include

• The product and version: client version (Settings or Apps in Windows), or the portal address you tested.
• What the vulnerability is and the impact you see (for example elevation of privilege, data of another tenant, authentication bypass).
• Steps to reproduce, with a proof of concept if you have one.
• Whether you believe it is being exploited, and how you know.
• How you want to be credited, or that you do not want to be named.

What we commit to

• Acknowledge your report within 2 business days.
• Give you a first assessment within 10 business days, and keep you updated at least every 14 days until it is fixed.
• Fix confirmed vulnerabilities without undue delay and provide security updates free of charge.
• Tell you before we publish, and credit you in the published information if you want.

Business days are Monday to Friday, except Danish public holidays.

Coordinated disclosure

We agree a disclosure date with you. Our default is 90 days after your report, or earlier when a fix is released. We may ask for more time when a fix needs a new Microsoft-attested driver, and we will tell you why. Please keep the details confidential until the agreed date.

When a vulnerability is fixed, we publish what was affected, the impact, the severity and how to fix it, in the release notes and to the customers concerned.

Reporting to the authorities

Logic Unknown ApS reports actively exploited vulnerabilities and severe incidents that affect AdminExplorer to the CSIRT designated as coordinator and to ENISA, through the ENISA Single Reporting Platform, as the EU Cyber Resilience Act requires. Information from your report may be shared with them for that purpose; we will tell you if it is.

Scope

• The AdminExplorer client for Windows: the kernel driver, the service, the tray app, the right-click menu (shell extension) and the installer.
• The AdminExplorer portal: portal.adminexplorer.io, its API, and partner portals running on it.
• This documentation site: docs.adminexplorer.io.
• The product website: adminexplorer.io.

Out of scope

• Testing against other customers: do not access, change or delete data that is not yours. Use your own installation or a trial tenant you created, and stop and report as soon as you see data that is not yours.
• Denial of service, load testing, spam, social engineering and physical attacks.
• Findings without a security impact, and output from automated scanners without a demonstrated issue.
• Missing headers or best-practice settings on static pages without a demonstrated exploit.
• Services we do not control, such as Microsoft Azure, Microsoft Entra ID, other identity providers, Cloudflare and your own IT systems. Report those to their owners; we help coordinate when AdminExplorer is involved.

Safe harbour

If you act in good faith and follow this policy, Logic Unknown ApS will not take legal action against you or report you to the police for your research, and we will consider your research authorised. If a third party takes legal action against you for research that followed this policy, we will make it known that you acted in line with it. This does not authorise you to break the law or to access data of others.

Keeping this policy current

The security.txt files carry an expiry date (currently 1 October 2027) and are renewed at least once a year, before they expire. This policy is reviewed at the same time.

Contact

Logic Unknown ApS, CVR 40560483, Humlevej 20, 8543 Hornslet, Denmark. security@adminexplorer.io, support@adminexplorer.io.