How to report
Email security@lazaretto.dev. Please include enough detail to reproduce it: the endpoint or URL, the steps, and any request and response. For anything sensitive, ask us for an encrypted channel first.
Our commitments to good-faith researchers
- We will acknowledge your report within 3 business days.
- We will not pursue or support legal action against research conducted in good faith and in line with this policy.
- We will keep you updated, and credit you if you like.
Please do
- Test only against your own accounts and artifacts.
- Stop and report as soon as you find a vulnerability; do not exfiltrate data or degrade service.
- Give us reasonable time to remediate before public disclosure.
Reporting a wrong verdict
Lazaretto is a signals provider. Did we return malicious or flagged on
something you publish, and you think it is wrong? Use
disputes@lazaretto.dev. We also want to hear about anything we
missed. Send that to the security address above. Both make the product better.
Machine-readable contact: security.txt.