Only the latest release (main branch) receives security updates.

Please do not open a public issue. Instead, send a report to security@lexicon.internal. We will respond within 48 hours and provide an estimated timeline for a fix.

We reward responsible disclosure of previously unknown vulnerabilities.

• Rewards: $50–$500 depending on severity.
• Scope: All services in this repository, excluding third-party dependencies.
• Rules:
  • Do not access or modify other users' data.
  • Stop testing and report immediately upon discovering a vulnerability.
  • Public disclosure only after our confirmation and fix.

We follow coordinated disclosure. After a fix is released, we publish a security advisory on GitHub.

Contributors who reported valid vulnerabilities will be listed here (with permission).