HomeVulnerability disclosure
Vulnerability disclosure.
We take security seriously. We welcome responsible disclosure of vulnerabilities in the grimm.lt and pdvs.lt systems — this policy explains how we work with security researchers.
In short
PDVS-VDP-01- Reports
- security@grimm.lt
- In scope
- grimm.lt · pdvs.lt
- Safe harbour
- Applies to good-faith research
- Reward
- up to EUR 2,000
- Effective from
- 2026-09-20
For the good-faith researcher
Follow these guidelines and we will not pursue legal action against you.
Two services
Two services are open to research: grimm.lt and pdvs.lt. Client installations are not.
Reward by impact
We weigh real impact and report quality, not the number of findings.
Guidelines for ethical research
When testing the grimm.lt and pdvs.lt systems, please follow four rules.
Be careful
Do not access, modify or delete data that is not yours. Do not degrade system performance or disrupt the service for other users.
Stay in bounds
Only test what is explicitly in scope. Do not attempt to reach systems or data outside it.
Communicate responsibly
Report the vulnerability promptly and give us enough detail to reproduce and fix it.
Keep it confidential
Do not disclose the vulnerability publicly until we have fixed it and you have our explicit permission to publish.
Safe harbour promise
If you follow these guidelines, we promise:
No legal action
We will not go to law enforcement or bring claims against researchers who discover and report a vulnerability in good faith, in line with this policy.
Good-faith collaboration
We will work with you to understand and resolve valid, manually validated findings. Due to the volume of AI-generated submissions we receive, response times vary and we cannot guarantee a fixed acknowledgement window.
In scope
The following MB GRIMM.LT services are open to security research:
grimm.lt
The company website and the forms running on it.
pdvs.lt
The PDVS product website, the demo environment and the client portal.
Client installations on their own domains are not in scope — testing those requires the written permission of that client.
Out of scope
The following are excluded from the programme and do not qualify for a reward:
- Attacks requiring physical access to devices or networks.
- Social engineering (phishing, vishing, pretexting).
- Denial of service (DoS, DDoS) attacks.
- Spam or email bombing.
- Vulnerabilities in third-party services or dependencies we do not maintain.
- Issues in third-party applications, integrations or browser extensions we did not build.
- Vulnerabilities in outdated browsers, plugins or other third-party software.
- Clickjacking with no meaningful security impact.
- Certificate transparency log issues.
- Publicly accessible files or directories that contain no sensitive data.
- Missing security headers that do not lead to a tangible vulnerability.
Severity and rewards
We assess vulnerabilities by severity and real impact:
Reward amounts are at our discretion and depend on the real impact, the quality of the report and whether the vulnerability has already been reported.
How to report
If you find a vulnerability that is in scope, write to us:
In the report, please include:
- A clear description of the vulnerability.
- Steps to reproduce it.
- Screenshots or a proof of concept, if you have one.
We receive a high volume of reports, many of them generated by AI tools and never validated by a human. We therefore cannot guarantee a fixed response time, and reports that appear AI-generated and unvalidated will not receive a reply. Please verify your finding yourself before sending it — otherwise it will not be triaged.
We will keep you posted on the progress of valid findings. Thank you for helping keep PDVS secure.