Security

Security practices, vulnerability reporting, and infrastructure protection for List Coder.

Security

List Coder takes security seriously. This page outlines our security practices, infrastructure protections, and how to report vulnerabilities.

Infrastructure Security

Encryption

  • In Transit: All data transmitted between List Coder and our servers is encrypted using TLS 1.3
  • At Rest: User data stored on our servers is encrypted using AES-256
  • Local: On-device telemetry is encrypted before transmission

Access Control

  • Role-based access control (RBAC) for all internal systems
  • Multi-factor authentication (MFA) required for all employee accounts
  • Principle of least privilege enforced across all services

Monitoring

  • 24/7 automated security monitoring
  • Real-time anomaly detection on API endpoints
  • Automated vulnerability scanning in CI/CD pipelines

Hardware Fingerprinting

To prevent abuse and Sybil attacks on our free AI servers, List Coder collects hashed hardware fingerprints:

  • CPU ID
  • BIOS serial number
  • Motherboard serial number
  • Disk serial numbers
  • Windows username

This data is stored hashed (one-way) and is used solely to enforce bans against users who violate our Terms of Service.

Ban Signatures:

Hashed hardware ban signatures are retained for 5 years under LGPD Art. 7, IX and GDPR Art. 6(1)(f) (Legitimate Interest). Deleting your account does not remove active ban signatures.

AI Model Security

Data Sanitization Pipeline

Before any telemetry leaves your device, it passes through our multi-layer sanitization pipeline:

  1. Local Obfuscation — Variable names, string literals, and comments are stripped
  2. Regex Scanning — Hundreds of patterns detect secrets, keys, and PII
  3. Aggregation — Data is combined with thousands of other users' data
  4. Final Check — Automated verification before transmission

Hard Blocked Data

The following are never transmitted, even accidentally:

  • Passwords and API keys
  • SSH/private keys
  • Authentication tokens
  • PII (emails, phone numbers)
  • Business-sensitive code comments

Vulnerability Reporting

If you discover a security vulnerability in List Coder, please report it responsibly.

How to Report

  1. Email List-Enterprise@outlook.com with details of the vulnerability
  2. Include steps to reproduce the issue
  3. Do not disclose the vulnerability publicly until we have addressed it

What to Include

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact assessment
  • Any suggested fixes (optional)

Response Timeline

  • Acknowledgment: Within 48 hours
  • Assessment: Within 5 business days
  • Fix Deployment: Depends on severity, typically within 30 days

Bug Bounty Program

We offer recognition and rewards for valid security reports:

SeverityReward
Critical (RCE, data leak)$500 – $2,000
High (auth bypass)$200 – $500
Medium (XSS, CSRF)$50 – $200
Low (info disclosure)Recognition + swag

Compliance

  • SOC 2 Type II — In progress
  • GDPR — Full compliance with Standard Contractual Clauses
  • LGPD — Compliance with Brazilian data protection regulations
  • CCPA — California Consumer Privacy Act compliance

Contact

For security inquiries, contact List-Enterprise@outlook.com.