Report a security issue

Last updated: 10 October 2026

Law firms use LEXSUB to hold confidential information about their deals, lawyers and clients. If you find a weakness that could put that information at risk, please tell us. This page explains how to report it, what we ask of you while you test, and what you can expect from us.

This page is for reporting a security issue. For how we protect firm data (hosting in France, an encryption key unique to each firm, two-factor sign-in on staff pages), see "How we protect your data" in our privacy policy.

How to report

Email security@lex-submission.com. You can write in English or French. If your report includes sensitive details, such as a working exploit or data you came across, encrypt it with our PGP key.

Please don't use the Talk to Sales form or any other channel for security reports.

What to include

The URL or the part of the app that is affected.
The steps to reproduce it. Screenshots or a short video help.
What an attacker could do with it.
Whether you saw any data that isn't yours, and what.
How you would like to be credited, if at all.

What's covered

The LEXSUB app at vault.lex-submission.com.
This website, lex-submission.com.

Accounts are by invitation only, and we don't provide test accounts, even on request. Without an account, you can test the pages anyone can reach, such as sign-in, password reset and the Talk to Sales form.

What isn't covered

Reports from automated scanners that don't show a real impact.
Missing security headers, cookie flags or other best practices, unless you show how they can be exploited.
Clickjacking on pages with no sensitive action, self-XSS, and cross-site request forgery on sign-out.
Reports about rate limits or brute force, unless you show a practical way to take over an account or guess a secret.
Email spoofing, unless you show a way around our SPF, DKIM or DMARC records.
Attacks that need physical access to a device, or a device or browser that is already compromised.
Vulnerabilities in services we use but don't run, such as our hosting and email providers. Report those to the provider. A mistake in how we have set them up is covered.
The websites of Chambers, Décideurs (Leaders League), Legal 500 and ODA. They are independent of LEXSUB.

While you test

Don't create accounts, and don't sign in to or use any account that isn't yours.
If you're a LEXSUB user, tell us about anything you notice while using your own account. Don't run tests that change, delete or expose your firm's data, and don't try to reach another firm's.
Don't try to get an invitation or an account by social engineering, by posing as a law firm or anyone else, or through the Talk to Sales form.
Send password-reset emails only to addresses you control.
Every Talk to Sales submission reaches a real person. Keep test submissions to a minimum.
If you reach data that isn't yours, stop. Look at no more than you need to show the issue. Don't copy, keep, change, delete or share it, and tell us right away what you saw and where.
Don't degrade the service for others: no denial of service, load testing or high-volume scanning.
No phishing or social engineering of our staff or our customers, and no physical attacks.
Keep the details confidential until the issue is fixed and we have agreed a disclosure date with you.

What happens next

We'll confirm that we've received your report within 2 business days.
Within 5 business days, we'll tell you whether we could reproduce the issue and how serious we think it is.
We'll keep you informed until it's fixed, at least every 14 days.
When it's fixed, we'll tell you, and we'll agree with you when and how it can be made public.

Safe harbour

If you follow this policy in good faith, we consider your research authorised. We won't take legal action against you or file a complaint about it. If someone else takes legal action against you for research done under this policy, we'll confirm that you acted with our permission.

This doesn't extend to services we don't run (see "What isn't covered").

Thanks

We don't offer a bug bounty or any other reward for reports. If you ask us to, we'll credit you publicly once the issue is fixed, by including your name or handle in our communications about the fix. If you'd rather stay anonymous, we won't name you.

PGP key

Use this key to encrypt your report. After you import it, check that its fingerprint matches the one shown here and on keys.openpgp.org, which we don't run.

Fingerprint: 3DEE 8A44 36E9 0043 FADE FE81 F070 554C E1F9 F6CB
User ID: GM <security@lex-submission.com>
Valid until: 5 October 2029

Download key