Vulnerability Disclosure Policy & Safe Harbor
Lightlab is committed to ensuring the security, integrity, and privacy of our systems and client infrastructures. We welcome responsible security research and value the contributions of the global security community.
Our Legal Protection for Ethical Researchers
Lightlab considers security research conducted under this policy to be authorized conduct. If you make a good faith effort to comply with this policy during your security research, we will:
- Not initiate or pursue legal action against you under computer abuse laws or anti-hacking statutes.
- Not report your research to law enforcement unless required by law.
- Work cooperatively with you to understand, validate, and remediate the vulnerability promptly.
- Publicly acknowledge your responsible disclosure in our Security Hall of Fame.
Target Scope
- • https://lightlab.work and all subdomains
- • Publicly accessible Cloudflare Edge Workers & APIs
- • Lightlab open-source defense tools & repositories
- • RFC 9116 security endpoints and manifests
- • Denial of Service (DoS / DDoS) testing
- • Social engineering or phishing of Lightlab personnel
- • Physical attacks on personnel or facilities
- • Exfiltration or modification of client/user data
Coordinated Disclosure SLA & Timeline
We acknowledge receipt of your report and assign a tracking incident ID.
Our defensive engineering team reproduces the PoC and confirms CVSS rating.
Verification in staging sandbox, patch deployment, and Hall of Fame credit.
How to Submit a Security Report
Please send your report to our dedicated security operations desk. For sensitive vulnerability disclosures, encrypt your transmission using our official OpenPGP key: