Skip to content
Skip to content

Report a security issue

Found a possible security problem in Lithi? Email our security team privately, include what helps, and test only what you're allowed to.

Updated
Email the security team.
Send a private report about one issue. Leave out secrets and customer data.
security@lithi.ai
What happens after I send it?
An acknowledgment confirms we received it. It doesn't promise a response time, a fix, a reward or safe harbor.
What a security report establishes

What to include

Keep it short and focused on one issue:

  • What's affected: the product area, page or interface, with a URL if you have one.
  • What happened: what you expected, what you saw instead, when, and in which environment.
  • How to see it safely: the smallest steps that show the problem, using an account you're allowed to test.
  • Why it matters: the impact you saw. Say if you couldn't confirm an effect.
  • How to reach you: a safe way to reply. Never use a password, token or customer record as contact detail.

Screenshots and timestamps help if they contain nothing sensitive. You don't need a polished exploit, and if a result was inconsistent, say which step is uncertain.

Test safely

Test only systems and accounts you're allowed to use. Stop as soon as the behavior is clear, or sooner if continuing could change, delete, expose or interrupt data or service.

  • Don't use social engineering, denial of service, physical access or destructive tests.
  • Don't use anyone else's account or data, guess or reuse credentials, or bypass a permission.
  • Don't change or export data, send real messages to anyone, change service settings, or keep access longer than you need to confirm the issue.
  • Ask before testing anything that could affect other people or a live service.
  • If you find personal information, customer content or a secret, stop. Keep only what identifies the issue, redact the rest, and share it only through this private channel.

Reporting doesn't grant access or permission to test third parties, or to test beyond the system, account and behavior you describe.

Our reporting address is also published in security.txt.