Security

Last updated: October 10, 2026

LOGOS runs inside engineering organisations, many of them on managed or air-gapped networks. This page says how to report a security problem to us, what we do about it, how releases are published and checked, and where fixed problems are listed.

Reporting a vulnerability

Write to security@logosmodular.com. Please include the product and version (Help → About, or the LOGOS Server console’s Settings → Updates), what you found, and the steps to reproduce it. Do not send customer data, models, or pool files; if the report needs a sensitive attachment, ask first and we will arrange a safe way to send it.

• We acknowledge a report within 3 business days and tell you who is handling it.
• We assess it and tell you what we found, normally within 10 business days.
• We fix confirmed problems in a release, publish an advisory below, and credit you if you wish.
• We ask that you give us up to 90 days before publishing details, or until a fixed release is out if that is sooner.

Scope and good-faith research

In scope: the LOGOS programs (Systema, Agora, Kanon, Hodos, Kindynos), the LOGOS Server and its web console, the licensing service at licensing.logosmodular.com, and this website. Test the programs and the LOGOS Server on your own installation.

We will not take legal action against research done in good faith under these rules: no access to, change, or deletion of other people’s data; no denial-of-service or load testing of our services; no social engineering of our staff or customers; no physical attacks; and stop and tell us as soon as you reach data that is not yours. We do not run a paid bounty program.

Security advisories

Each fixed vulnerability is listed here with the versions affected, the version that fixes it, its severity, and what to do. Customers with an active licence are also told by email.

Releases and updates

• LOGOS never updates itself. There is no update check in the programs and nothing is downloaded or installed in the background. Your IT department installs a release when it chooses.
• The installers are signed MSIs that install silently, so they can be pushed with Intune, Configuration Manager, or Group Policy. They are in My Account for an active licence.
• Every release is published with its SHA-256 checksums, a software bill of materials (CycloneDX), and the security summary for IT, so each can be checked before it is installed.
• A LOGOS Server that is online reads our public release list once a day and shows its administrator a notice when a newer release exists. An air-gapped server asks for nothing.
• An update never changes your files. Models, projects, organisation files, and pools are changed only by a person’s own save or by Agora’s check-out and check-in.

For IT and security reviewers

The security summary for IT that ships with each release describes what LOGOS reads and writes, its network use, cryptography, group-policy settings, silent installation, and allow-listing. Ask security@logosmodular.com for the summary, checksums, and bill of materials of any release before you buy or install.