Vulnerability Disclosure

Lanterna Technologies Inc. (“Lanterna Tech”) welcomes vulnerability reports. This policy explains how to reach us, what is in scope, and what you can expect from us. Effective July 28, 2026.

01Reporting a vulnerability

Email [email protected]. Please do not open a public issue, and do not disclose publicly before we have had a reasonable opportunity to fix the issue.

A good report includes, where possible:

• a clear description of the issue and its concrete impact;
• steps to reproduce (URL, request, screenshot);
• the version or approximate date at which you observed it;
• whether you would like credit, and under what name;
• whether you have already shared it with a third party.

02What you can expect from us

Lanterna Tech is a small team. We will not promise a numeric deadline we could not reliably meet. Instead we commit to acknowledging your report as soon as we can, telling you whether we accept it and why, keeping you posted as a fix progresses, and letting you know when it ships. We favour coordinated disclosure and will agree the timing of any publication with you.

03Scope

In scope:

• the website and web application on lanternatech.com and its subdomains;
• API endpoints under /api/ and the real-time WebSocket channel;
• public share links;
• authentication flows: sign-in, TOTP two-factor, passkeys, password reset, token rotation;
• tenant isolation (access to another organization’s data);
• privilege escalation (user → admin, admin → superadmin);
• injection, deserialization, server-side request forgery (SSRF) and mass-assignment flaws.

04Out of scope

• denial-of-service, volumetric or resource-exhaustion attacks;
• a missing security header, absent a demonstrated exploit;
• “self-XSS” requiring the victim to paste code into their own console;
• automated scanner output without a working proof of concept;
• best-practice recommendations without a concrete vulnerability;
• social engineering, phishing of our staff, and physical attacks;
• third-party services we depend on — please report those to their vendor.

05Rules of engagement

Test only with an account you own. Stop as soon as you have confirmed the vulnerability: do not access more data than is needed to demonstrate it, do not modify or destroy data, and do not disrupt the service. Never test against a customer’s data without their written authorization.

06Safe harbour

We will not bring civil or criminal action against you, nor ask a third party to do so, if you comply in good faith with this policy — including the rules of engagement in Section 5. If a third party brings action against you for work that complied with this policy, we will say so. This commitment does not extend to conduct beyond this policy, nor to anything mandatory law prevents us from covering.

07Recognition

We do not operate a paid bug bounty. With your permission, we will publicly credit you for any accepted report. Please report regardless of compensation — we treat every serious report the same way.