Security disclosure

In scope for good-faith testing:

• legacycore.com and www.legacycore.com (public marketing and verification surfaces)
• registry.legacycore.com (Public Business Trust Registry, verification, legal pages)
• Public verification URLs of the form /verify/LC-XXXXX and public credential records

Partner and business portals, and any host that is not listed above, are out of scope unless we say otherwise in writing.

If you research in good faith, stay in bounds, and report promptly, Legacy Core will not pursue legal action against you for that research. “Good faith” means you did not harm customers, did not keep copies of other businesses' data, and did not use a finding to threaten or extort.

This is not a license to break the law. We still have to cooperate with a lawful request from law enforcement.

Do not:

• Social-engineer our staff, partners, or credentialed businesses
• Run denial-of-service tests, flood traffic, or degrade the registry for others
• Access, copy, or exfiltrate another business's assessment evidence, account, or non-public record
• Physical testing of offices, mail, or discarded media
• Spam, phishing, or malware as a “test”

Email security@legacycore.com. Include the URL or credential ID, what you observed, and enough detail for us to reproduce it. Do not attach other businesses' data.

We aim to acknowledge a valid in-scope report within 5 business days and to say whether we can reproduce it within 15 business days. Fix timing depends on severity.

If you write and hear nothing, follow up once. Do not disclose a finding publicly until we have had a reasonable chance to fix it.

Legacy Core does not run a paid bug bounty. We will say thank you, and we will fix what we can reproduce. We may credit a researcher by name if you ask us to and the write-up does not put others at risk. There is no payment, swag obligation, or points program.