Security & responsible disclosure

Lazaretto is a security product, and we hold ourselves to the same standard we ask of the artifacts we inspect. If you have found a vulnerability in our service, or believe we returned a wrong result, we want to hear from you.

How to report

Email security@lazaretto.dev. Please include enough detail to reproduce: affected endpoint or URL, steps, and any request/response evidence. For sensitive findings, ask us for an encrypted channel before sending details.

Our commitments to good-faith researchers

We will acknowledge your report within 3 business days.
We will not pursue or support legal action against research conducted in good faith and in line with this policy.
We will keep you updated as we investigate, and credit you if you would like.

Please do

Test only against your own accounts and artifacts.
Stop and report as soon as you find a vulnerability; do not exfiltrate data or degrade service.
Give us reasonable time to remediate before public disclosure.

Reporting a wrong verdict

Lazaretto is a signals provider. If we returned malicious or flagged on an artifact you publish and you believe it is wrong, use disputes@lazaretto.dev. A missed detection (a false negative) is equally welcome at the security address above. Both make the product better.

Machine-readable contact: security.txt.