Contact: mailto:security@lockupscan.dev
Contact: mailto:powellb.elev8ai@gmail.com
Expires: 2027-05-12T00:00:00.000Z
Preferred-Languages: en
Canonical: https://lockupscan.dev/.well-known/security.txt
Policy: https://lockupscan.dev/security
Acknowledgments: https://lockupscan.dev/security#thanks

# LockUp Security Disclosure Policy
#
# We welcome reports of security issues affecting LockUp itself
# (lockupscan.dev) or any subdomain. If you believe you have found a
# vulnerability, please email us at the addresses above. We aim to
# acknowledge new reports within 24 hours and to provide a meaningful
# update within 5 business days.
#
# In scope:
#   * lockupscan.dev and all subdomains
#   * Our authentication, payment, and scan APIs
#   * Our LockUp Trust Report verification flow
#
# Out of scope:
#   * Vulnerabilities in third-party customer assets that LockUp
#     scans on the customer's behalf (please disclose to the asset
#     owner directly).
#   * Social-engineering attacks against LockUp staff.
#   * Denial-of-service findings produced by aggressive scanning of
#     our own endpoints.
#
# Safe harbour: if you act in good faith and within the scope above,
# we will not pursue legal action against you for the act of
# discovering and reporting a vulnerability. We ask only that you
# give us a reasonable window to remediate (default 90 days) before
# public disclosure.
#
# Last reviewed: 2026-05-12