---
title: "Security and responsible disclosure. Lazaretto"
description: "How to report a vulnerability in Lazaretto, and our commitments to good-faith researchers."
url: "https://lazaretto.dev/security"
---

[Home](https://lazaretto.dev/) / [Trust](https://lazaretto.dev/trust) / Security

Responsible disclosure

# Security & responsible disclosure

Lazaretto is a security product, and we hold ourselves to the standard we ask of others. Did you find a bug in our service, or get a wrong result? Please tell us.

## How to report

Email [security@lazaretto.dev](mailto:security@lazaretto.dev). Please include enough detail to reproduce it: the endpoint or URL, the steps, and any request and response. For anything sensitive, ask us for an encrypted channel first.

## Our commitments to good-faith researchers

- We will acknowledge your report within **3 business days**.
- We will not pursue or support legal action against research conducted in good faith and in line with this policy.
- We will keep you updated, and credit you if you like.

## Please do

- Test only against your own accounts and artifacts.
- Stop and report as soon as you find a vulnerability; do not exfiltrate data or degrade service.
- Give us reasonable time to remediate before public disclosure.

## Reporting a wrong verdict

Lazaretto is a signals provider. Did we return `malicious` or `flagged` on something you publish, and you think it is wrong? Use [disputes@lazaretto.dev](mailto:disputes@lazaretto.dev). We also want to hear about anything we missed. Send that to the security address above. Both make the product better.

Machine-readable contact: [security.txt](https://lazaretto.dev/.well-known/security.txt).

---

Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.