Security & disclosure
Report a security issue.
To report a security vulnerability in an Invoke website or service, email security@invokellc.com with the details and steps to reproduce it. We review every report, keep you informed while we fix it, and ask that you give us reasonable time to resolve it before sharing it publicly.
Reporting
What to include.
Clear details help us confirm and fix the issue faster. Please don't include more personal or customer data than you need to show the problem.
- The website address or service affected
- What the issue is and the impact you think it has
- Steps to reproduce it, with screenshots or a proof of concept if you have one
- How we can reach you, if you want updates
Guidelines
Test in good faith.
We won't take legal action against researchers who act in good faith and follow these guidelines.
- Only test against systems you own or that are in scope, and stop as soon as you confirm the issue.
- Don't access, change or delete data that isn't yours. If you reach personal or customer data, stop and tell us.
- Don't degrade our services: no denial-of-service, spam or high-volume automated scanning.
- Don't use social engineering, phishing or physical attacks against Invoke people or offices.
- Keep the details confidential until we confirm the issue is fixed.
This website
How we protect invokellc.com.
We hold our own website to the standards we recommend to customers.
- Pre-built pages
The site is static HTML published from version control. No server-side code or database runs behind it.
- Strict Content Security Policy
Browsers load only what we explicitly allow, and we keep third-party code to a minimum.
- Encryption everywhere
HTTPS only, with HSTS and TLS 1.2 or later.
- Two-person changes
Every change is reviewed and approved by a second person before it can go live, and previews require Microsoft Entra sign-in.
Questions
Security reporting, answered.
How do I report a security vulnerability to Invoke?
Email security@invokellc.com with the affected address or service, a description of the issue and steps to reproduce it. Our security.txt file at /.well-known/security.txt lists the same contact.
What is in scope?
Websites and services that Invoke operates, including www.invokellc.com. Products from other companies, such as Microsoft or Cloudflare, are out of scope; please report those to the vendor's own program.
Does Invoke pay bug bounties?
No. We don't run a paid bug bounty program, but we're grateful for responsible reports and will thank you for your help.
Looking for security help, not reporting an issue?
Talk to an Invoke practitioner about identity, threat protection, data security or endpoint management on Microsoft.