Policy
Vulnerability Disclosure Policy
Liberty Security Services, LLC — AS21990
Liberty Security Services welcomes reports of security vulnerabilities in the network infrastructure we operate. This policy explains what is in scope, how to report, and what you can expect from us.
How to report
Email security reports to noc@as21990.net, or use the contacts listed in security.txt.
Please include enough detail for us to reproduce the issue: affected address or hostname, the behaviour observed, and the steps that produced it. If the finding is time-sensitive or being actively exploited, say so in the subject line.
We accept reports in English.
What we commit to
| Acknowledge your report | Within 2 business days |
| Initial assessment | Within 5 business days |
| Progress updates | At least every 10 business days while open |
| Credit | On request, once the issue is resolved |
Business days are Monday to Friday, excluding U.S. federal holidays. Our NOC operates 07:00–21:00 Eastern.
We do not operate a paid bug bounty and cannot offer financial rewards.
Scope
In scope
- The IP address space we originate: 206.109.108.0/23
- Our public-facing DNS for as21990.net
- as21990.net itself
- Routing security issues affecting AS21990 — route hijacks, RPKI or IRR problems, BGP session weaknesses
Out of scope
- Anything hosted by our customers on address space assigned to them. Report those to the operator concerned; if you cannot identify them, send it to abuse@as21990.net and we will route it.
- Third-party services we consume rather than operate, including our upstream transit providers and our website host
- Findings that require physical access to our premises or equipment
- Social engineering of our staff or customers
- Volumetric denial-of-service demonstrations. We accept reports describing a DoS weakness; we do not want it proven against production.
What we ask of you
- Do not access, modify, or delete data that is not yours. If a vulnerability exposes data, stop at the point you have demonstrated access.
- Do not degrade our service. No volumetric testing, no sustained scanning, no actions likely to affect customers.
- Give us reasonable time to remediate before disclosing publicly. We suggest 90 days from acknowledgement, and will tell you if something needs longer and why.
- Do not extort. A report conditioned on payment is not a disclosure.
Safe harbour
If you make a good-faith effort to comply with this policy, we will not pursue or support legal action against you in relation to your research, and we will make it known that your actions were authorised if a third party raises the question.
This is our commitment and not a statement of law. It does not bind third parties, and it does not apply to conduct outside this policy.