What a security report establishes
What happens after you send a Lithi security report, what our acknowledgment confirms, and what it doesn't promise you.
A security report tells us about an issue you want Lithi to investigate. Our acknowledgment confirms we received it, and nothing more.
Haven't sent a report yet?
See what to include and how to test safely first.
Following up on a report?
Reply with your report reference and only the extra detail needed.
What a report does and doesn't establish
| A report establishes | A report doesn't establish |
|---|---|
| What you reported, and when | A time for acknowledgment or a fixed response window |
| The affected surface, behavior and evidence you sent | The cause, a fix or a remediation timeline |
| A reference you can use to follow up | A reward, safe harbor, legal protection, access, or permission to test third parties |
While we review it
An issue stays open until its scope and evidence are reviewed. An acknowledgment isn't a resolution, and closing a report doesn't mean no issue existed.
What the report record is
The record answers one question: what was reported, and when. It isn't an incident notification, a security assessment, an audit artifact or a certification. For scoped review evidence, see compliance and assurance.