Vulnerability Disclosure Policy
How to report a security issue, and our safe-harbour commitment.
Version 1.0 · In effect from 15 October 2026 · Permanent link to this version
1. What this is
1.1 If you find a security vulnerability in Lemma, we want to hear about it, and we will not treat you as an attacker for telling us. This policy sets out what you may test, how to report it and what we promise in return. It is a coordinated vulnerability disclosure policy of the kind encouraged by Directive (EU) 2022/2555 (NIS2), Art. 12.
2. Scope
2.1 In scope
2.1.1 https://getlemma.io, https://app.getlemma.io and our public APIs, including the Verification API. 2.1.2 Our own published clients, and infrastructure we control directly at the domains listed at https://getlemma.io/.well-known/security.txt.
2.2 Out of scope
2.2.1 Systems run by our vendors — Vercel, Railway, Neon, Cloudflare, Stripe, LiveKit, Resend, Google (Firebase), Sentry, PostHog, Sanity, Telegram, Anthropic, OpenAI — report those under the vendor's own policy. How we configure or use a vendor is in scope. 2.2.2 Third-party services merely linked from Lemma, and anything belonging to a User or an API Client.
2.3 Out-of-scope test types
2.3.1 Denial of service, load testing, resource exhaustion and brute forcing. 2.3.2 Physical attacks on our offices or staff; social engineering, phishing or pretexting of staff, Users or vendors. 2.3.3 Automated scanning generating high volumes of traffic or spam. 2.3.4 Scanner output with no demonstrated impact, and theoretical or best-practice observations — missing headers with no exploit path, TLS configuration without a demonstrated attack, self-XSS.
3. Safe harbour
3.1 If you act in good faith and comply with this policy, we will not bring or support civil or criminal proceedings against you over your research, report you to law enforcement, or ask your employer or hosting provider to act against you.
3.2 We treat such research as authorised access to our systems for the purposes of computer-misuse law, and will confirm that in writing if a third party questions it or brings a claim against you.
3.3 Safe harbour covers our systems only. It cannot authorise access to a User's or an API Client's data, and does not override any law.
3.4 If you are unsure whether something is in scope, ask at security@getlemma.io first. Asking never counts against you.
4. Rules of engagement
4.1 Prove it, do not exploit it. Stop as soon as you have enough to demonstrate the issue.
4.2 No data exfiltration beyond proof of concept. Do not download, copy, retain or transmit our data or a User's data beyond the minimum needed to show the vulnerability exists. Never a bulk dump.
4.3 Do not access another User's data. Use accounts you own; create a second one if the test needs it.
4.4 Stop and report on encountering personal data. Stop immediately, do not look further, tell us at once, delete anything you hold and confirm the deletion. This may put us on notice of a breach under GDPR Art. 33, and our clock starts when you tell us.
4.5 Do not degrade the service. No destructive testing, no modifying or deleting data that is not yours, no persistent backdoors, nothing that would interrupt a live Session.
4.6 No extortion, and comply with the law, including data protection law, throughout.
5. How to report
5.1 Email security@getlemma.io. We do not currently publish a PGP key; if your report contains sensitive detail, ask us first and we will agree a secure channel. Machine-readable contact details are at https://getlemma.io/.well-known/security.txt (RFC 9116).
5.2 Please include: what the vulnerability is and where; steps to reproduce, ideally with a minimal proof of concept; what an attacker could achieve; anything you accessed; and how you would like to be credited.
5.3 Reports in English or Russian are welcome (our security.txt lists both). Anonymous reports are accepted, but we cannot then keep you updated.
6. What we promise
6.1 Acknowledgement within 72 hours of receipt.
6.2 Triage and initial severity assessment within 5 working days, telling you whether we think the issue is valid and how serious it is.
6.3 Progress updates at least every 14 days until the issue is resolved or closed.
6.4 Target remediation: critical within 7 days, high within 30 days, others on a schedule we tell you. We confirm when it is fixed and credit you if you want.
7. Coordinated disclosure
7.1 Please give us 90 days from your report before publishing, so we can fix the issue and protect Users. If we fix it sooner, you may publish once the fix is deployed. If we need longer, we will explain why and agree a new date with you; we will not use an extension to bury a report.
7.2 Please omit personal data from any publication, and do not include a working exploit against live systems.
7.3 Where an issue affects Users we publish our own advisory, and where the law requires it we notify affected Users and the Office of the Commissioner for Personal Data Protection (GDPR Arts. 33 and 34).
8. Bounties
8.1 Reward position: we do not run a paid bug bounty. We offer public credit, if you want it, for valid reports.
8.2 Safe harbour under section 3 does not depend on whether a reward is paid.
9. Contact
9.1 Security: security@getlemma.io. Everything else: support@getlemma.io. Personal data: privacy@getlemma.io.