Trust Center · Vulnerability Disclosure Policy
Vulnerability Disclosure Policy
Last updated October 14, 2026
This policy applies to any vulnerability you are considering reporting to Lustena. Please read it fully before you report, and act in compliance with it. We value the time and effort of people who report vulnerabilities responsibly. We do not currently offer monetary rewards.
Reporting
If you believe you have found a security vulnerability in Lustena's systems, send a report to contato@lustena.ai with the subject Security. Include:
- The website, endpoint, package or page where the vulnerability can be observed.
- A brief description of the type of vulnerability, for example cross-site scripting.
- Steps to reproduce, as a benign, non-destructive proof of concept. This lets us triage quickly and reduces duplicate reports.
What to expect
- We acknowledge your report within five working days and aim to triage it within ten working days.
- Priority is assessed by impact, severity and exploit complexity. We keep you informed of progress.
- We notify you when the vulnerability is remediated, and may invite you to confirm the fix.
- Once resolved, we welcome coordinated public disclosure.
You must not
- Break any applicable law or regulation.
- Access, modify or retain unnecessary, excessive or significant amounts of data, including any employee's findings or content.
- Use high-intensity, invasive or destructive scanning tools.
- Attempt or report any form of denial of service.
- Disrupt Lustena's services or systems, or those of its customers.
- Report non-exploitable issues or best-practice deviations such as missing headers or TLS configuration notes.
- Social engineer, phish or physically attack Lustena's staff or infrastructure.
- Demand compensation in order to disclose a vulnerability.
You must
- Comply with data protection law and respect the privacy of any data Lustena or its customers hold.
- Securely delete all data retrieved during your research as soon as it is no longer required, or within one month of the vulnerability being resolved, whichever comes first.
Safe harbor
If you act in good faith and follow this policy, Lustena will not pursue legal action against you for your research and will treat it as authorized.
This policy is designed to be compatible with common vulnerability disclosure good practice. It does not give you permission to act in any manner inconsistent with the law, or which might cause Lustena or its partners to breach a legal obligation.