---
title: "Security and responsible disclosure. Lazaretto"
description: "How to report a vulnerability in Lazaretto, and our commitments to good-faith researchers."
url: "https://lazaretto.dev/security"
---

[Home](https://lazaretto.dev/) / [Trust](https://lazaretto.dev/trust) / Security

Responsible disclosure

# Security & responsible disclosure

Lazaretto is a security product, and we hold ourselves to the same standard we ask of the artifacts we inspect. If you have found a vulnerability in our service, or believe we returned a wrong result, we want to hear from you.

## How to report

Email [security@lazaretto.dev](mailto:security@lazaretto.dev). Please include enough detail to reproduce: affected endpoint or URL, steps, and any request/response evidence. For sensitive findings, ask us for an encrypted channel before sending details.

## Our commitments to good-faith researchers

- We will acknowledge your report within **3 business days**.
- We will not pursue or support legal action against research conducted in good faith and in line with this policy.
- We will keep you updated as we investigate, and credit you if you would like.

## Please do

- Test only against your own accounts and artifacts.
- Stop and report as soon as you find a vulnerability; do not exfiltrate data or degrade service.
- Give us reasonable time to remediate before public disclosure.

## Reporting a wrong verdict

Lazaretto is a signals provider. If we returned `malicious` or `flagged` on an artifact you publish and you believe it is wrong, use [disputes@lazaretto.dev](mailto:disputes@lazaretto.dev). A missed detection (a false negative) is equally welcome at the security address above. Both make the product better.

Machine-readable contact: [security.txt](https://lazaretto.dev/.well-known/security.txt).

---

Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.