Security Policy, Responsible Disclosure & Client Data Handling
At JOS LLC ("JOS"), protecting the integrity of our systems and the confidentiality of client information is foundational to our work. This page sets forth our Responsible Disclosure Policy for reporting security vulnerabilities in JOS-operated services, as well as our Client Data Handling Policy governing security assessment and verification engagements.
Scope
In-Scope Assets: Web properties and services under the josforge.com domain, and any other digital services officially published as owned and operated by JOS LLC.
Out-of-Scope Assets: Systems developed for or delivered to our clients, as well as any environments operated by our clients, are strictly out of scope for public vulnerability reporting. Security testing against client environments is conducted solely under formal written contracts with the respective client.
Prohibited Actions
When researching or verifying potential vulnerabilities, the following actions are strictly prohibited:
- Denial-of-Service (DoS / DDoS) attacks, automated high-volume scanning, or any action that degrades service availability
- Accessing, viewing, modifying, deleting, or exfiltrating data belonging to other users or third parties
- Social engineering (phishing, pretexting) or physical intrusion against JOS personnel or facilities
- Sending spam or unsolicited bulk messages
- Performing any action beyond the minimal steps required to demonstrate the existence of a vulnerability
How to Submit a Report
Security Contact: security@josforge.com
What to Include: Please provide the affected URL or component, vulnerability category, clear step-by-step reproduction instructions, potential impact assessment, and a benign Proof-of-Concept (PoC) if available.
Sensitive Reports & Encryption: We do not publish a public PGP key. For highly sensitive findings, please send a brief summary by email first, and we will provide a dedicated secure channel for transmitting detailed technical material.
Response Targets
Acknowledgment: We aim to acknowledge receipt of your report within 3 business days.
Initial Assessment: We aim to complete initial triage (validating authenticity and severity) and update the reporter within 10 business days of receipt.
Remediation: Confirmed vulnerabilities are prioritized by severity, and we will keep the reporter informed of progress. Because remediation timelines depend on architectural complexity, we do not guarantee a fixed completion deadline.
Safe Harbor
If you conduct security research in good faith and in full compliance with the scope, rules, and prohibited actions defined in this policy, JOS LLC will not initiate legal action against you and will not file a report with law enforcement under Japan’s Act on Prohibition of Unauthorized Computer Access or related statutes. Actions that violate the scope or prohibitions of this policy are not covered by Safe Harbor.
Coordinated Disclosure
Public disclosure of a reported vulnerability takes place only after remediation is complete and by mutual agreement with the reporter. To protect users and infrastructure, we ask reporters to observe a 90-day embargo from the date of initial receipt before any public disclosure.
Rewards & Recognition
JOS LLC does not offer monetary bug bounties, nor do we maintain a public Hall of Fame page. However, upon request, we are glad to provide individual written acknowledgment of your contribution.
In all vulnerability assessments, penetration tests, exploit verifications, and malware analysis engagements conducted for our clients, JOS LLC enforces the following data governance standards:
Isolated Verification Environments
All exploit reproduction, PoC testing, and malware analysis tasks are executed within JOS-managed isolated environments logically separated from client production networks, with outbound traffic restricted to an allow-list and logged.
Retention & Deletion of Raw Data (30 Days)
All raw diagnostic artifacts collected or generated during an engagement—including traffic logs, screenshots, configuration files, forensic samples, and extracted data—are permanently and irreversibly deleted within 30 days after final deliverable acceptance.
Retention of Final Reports (1 Year)
Final assessment reports (deliverables) are retained in encrypted storage for 1 year following contract completion to support re-testing and client inquiries, after which they are permanently deleted (or deleted earlier upon written client request).
Encrypted Delivery
All assessment reports, technical findings, and sensitive documentation are transmitted exclusively over encrypted channels using strong file encryption.
Contact: mailto:security@josforge.com Expires: 2027-11-30T00:00:00.000Z Preferred-Languages: ja, en, zh Canonical: https://www.josforge.com/.well-known/security.txt Policy: https://www.josforge.com/security-policy