Vulnerability Disclosure Policy
Last Updated: October 4, 20261. Purpose
Lantanios Solutions Inc. ("Lantanios") welcomes reports of security vulnerabilities in our platform. If you have found a problem, we want to hear about it and we would rather hear about it from you than from an incident.
This page explains how to report and what we consider in scope. It is not a contract and promises nothing.
2. How to Report
Email [email protected]. Please do not open a public issue, post details publicly, or share them with third parties before we have had a chance to respond.
A report is most useful when it includes:
- the affected URL, endpoint, or feature;
- a description of the vulnerability and why you believe it is exploitable;
- the steps needed to reproduce it, including any accounts or state required;
- what an attacker could achieve with it; and
- any proof-of-concept material, logs, or screenshots you already have.
Reports in English are easiest for us to act on quickly. We accept reports anonymously; we simply cannot follow up or credit you if you leave no way to reach you.
3. Good-Faith Research
We do not intend to take legal action against, or report to law enforcement, a person who makes a good-faith effort to follow this policy. This is a statement of intent. It is not a waiver of any right, and it does not authorize access to any system or data.
It cannot bind third parties, including the owners of sites built on Lantanios and the services we use. If you are unsure whether something is in scope, ask us first.
4. Scope
In scope:
- the Lantanios platform at lantanios.com, including its application and API surfaces; and
- sites published on Lantanios subdomains, where the vulnerability lies in the platform rather than in content a site owner authored.
Out of scope:
- third-party services we integrate with, including our payment processor and identity providers — please report those to the provider under their own disclosure programme, and tell us if the issue affects our customers;
- content, configuration, or custom code authored by an individual site owner, which is that owner's responsibility;
- denial-of-service, volumetric, or resource-exhaustion testing, and anything else that degrades service for other users;
- social engineering of our people or our customers, and physical attacks;
- findings that are only the unvalidated output of an automated scanner, with no demonstrated impact; and
- reports that amount to missing hardening headers or a weak configuration with no path to exploitation.
5. Rules of Engagement
While researching, please:
- use only accounts you own or have explicit permission to test, and create your own test accounts rather than using someone else's;
- stop as soon as you have confirmed a vulnerability — do not enumerate further records, pivot, or establish persistence;
- never access, modify, exfiltrate, or retain another person's data. If you encounter personal data incidentally, stop, do not save it, and tell us what you saw so we can assess the exposure;
- do not degrade, disrupt, or deface the service or its data; and
- respect privacy, and do not use a finding for any purpose other than reporting it.
6. What to Expect
We may acknowledge a report, assess it, tell you what we decide, and credit you if you want that. We do not promise a response, a response time, or a fix.
Lantanios does not currently operate a paid bug bounty programme and does not offer monetary rewards for reports. We say so plainly so you can decide how to spend your time.
7. Coordinated Disclosure
Please give us a reasonable opportunity to fix an issue before disclosing it publicly. We suggest 90 days from your report as a default.
8. Machine-Readable Contact
Our contact details are also published in machine-readable form, per RFC 9116, at /.well-known/security.txt.