Security policy

Reporting a vulnerability

If you find a security vulnerability in LumenFlow, report it privately. Do not file in any public tracker.

Email security@lumenflow.dev. Include:

• A description of the vulnerability
• Steps to reproduce
• The potential impact
• A suggested fix, if you have one

The machine-readable contact is at /.well-known/security.txt.

Response timeline

• Acknowledgment: within 48 hours
• Initial assessment: within 5 business days
• Fix timeline: depends on severity. The targets are:
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: next release

Supported versions

Version	Supported
latest	Yes
< latest	No

Security fixes ship in the latest release only. Run the most recent version.

Scope

In scope:

• Kernel: policy bypass, sandbox escape, evidence tampering
• Runtime: daemon privilege escalation, socket permission issues
• Packs: tool execution outside declared scopes
• Surfaces: input injection, authentication bypass
• Control Plane SDK: credential leakage, man-in-the-middle weaknesses

Out of scope:

• Vulnerabilities in dependencies (report them upstream, and tell us)
• Social engineering attacks
• Denial of service through resource exhaustion, unless trivially exploitable

Security advisories

Published advisories, with affected and fixed versions and upgrade guidance, are listed on the security advisories page. Exploit mechanics are withheld from advisories and release notes until most installations have upgraded.

Safe harbour

If you make a good-faith effort to follow this policy, report privately, avoid harm to other people’s data and services, and give us reasonable time to fix the issue, we will not pursue legal action against you for your research.

Recognition

We credit security researchers in our release notes, unless you prefer to stay anonymous. We do not offer a bug bounty program.