Security reporting
Report a suspected vulnerability.
Coordinated disclosure for LyraShield itself. Report privately using the steps below; please do not open a public issue for a suspected vulnerability.
Last reviewed:
Safe reporting
Email security@lyrashieldai.com with a concise description, impact, reproduction steps and a safe contact method. Do not include credentials, customer data, tokens, prompts, targets, findings or report contents.
Testing boundaries
Only test systems you own or have explicit authorization to assess. Do not perform denial-of-service, social engineering, automated high-volume scanning or destructive actions.
Response
Reports are acknowledged by a human and triaged by severity. LyraShield is in open beta: this page states no response-time commitment and runs no bounty programme and we will tell you plainly if a report falls outside our scope.
Machine-readable contact
This page is the policy referenced by /.well-known/security.txt, which carries the same contact address and an expiry date so automated disclosure tooling can verify the route is current. If that file is ever missing or expired, email security@lyrashieldai.com directly.
What is in scope
The published marketing site and the hosted product surfaces described in the integration guides. The open-source repository is public, so a defect visible in source is best reported as a private email first; we will agree on disclosure timing before anything is published.