Vulnerability Disclosure Policy
Effective: 16 May 2026 · Version 1.1 (updated 9 September 2026)
PanLuma welcomes reports from external security researchers. This page explains how to report a vulnerability safely, what is in scope, what is not, and what you can expect from us in return.
1. How to Report
Send a report to security@panluma.ai. The mailbox is monitored on business days; for time-sensitive issues, please also include the word URGENT in the subject line.
Please note that this mailbox does not page anyone out of hours — see §5 for what that means for our response times. If you believe an incident is in progress (data is being exposed right now, or an attacker holds live access), please say so in the first line of your report so we can triage it correctly when the mailbox is next read.
Please include in your report:
- A clear description of the issue and its potential impact.
- Steps to reproduce, including any required configuration, accounts, or test data.
- The URLs, endpoints, or components affected.
- Any proof-of-concept (script, screenshot, video). Please do not include actual customer data.
- Your name or handle, and how you would like to be credited (or whether you prefer to remain anonymous).
2. Safe Harbor
PanLuma will not pursue legal action against, support law enforcement investigation of, or terminate the accounts of researchers who, in good faith and consistent with this policy:
- Make a sincere effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.
- Only interact with accounts they own or have explicit permission from the account holder to test.
- Do not exfiltrate customer data beyond the minimum needed to prove the issue.
- Do not publicly disclose the issue before we have had a reasonable opportunity to remediate (see §5).
Activities outside the scope of this policy, or in violation of its conditions, are not covered by this safe-harbor commitment.
3. Scope
In scope:
- Applications:
app.panluma.ai(the PanLuma web application),www.panluma.ai(marketing site), the PanLuma desktop builds, the PanLuma iOS and Android apps. - APIs:
app.panluma.ai/api/v1/*, all MCP endpoints under/mcp/*. - Authentication and authorization: JWT handling, OAuth flows (Google, Microsoft), API key auth, RBAC, tenant isolation, RLS.
- Infrastructure surface exposed to the internet: CloudFront distributions, WAF, ALB.
Out of scope:
- Any third-party service we depend on (AWS, Anthropic, Google, Microsoft, PostHog, etc.). Report those directly to the vendor.
- Issues that require physical access to a user’s device, social-engineering attacks against PanLuma personnel, or attacks against PanLuma’s office network.
- Denial-of-service attacks, traffic-based attacks, brute-force or rate-limit testing at any scale that would impact availability for other users.
- Findings that depend on out-of-date or unsupported browsers, operating systems, or libraries.
- Findings that require an attacker to already control a user’s account or device (e.g., self-XSS via paste, missing autocomplete attributes).
- Disclosure of public information (e.g., software versions, the presence of a
robots.txt). - Vulnerabilities only present in pre-release branches that have not been deployed to production.
4. Things You Must Not Do
- Access, modify, or delete customer data that is not your own without explicit permission.
- Run automated scans that send more than a few requests per second.
- Test against the platform with payment-related transactions, denial-of-service, or social engineering.
- Publicly disclose the issue before the coordinated disclosure window in §5.
5. Response Targets and Coordinated Disclosure
| Stage | Target |
|---|---|
| Acknowledge receipt of report | 2 business days |
| Initial triage and severity assignment | 5 business days |
| Status update if remediation is ongoing | Every 14 days |
| Remediation (target, severity-dependent) | Critical: 24 hours · High: 7 days · Medium: 30 days · Low: 90 days |
| Coordinated public disclosure window | 90 days from initial report, or sooner with researcher’s agreement |
If we are unable to remediate within 90 days, we will communicate the reason and a revised timeline before the disclosure window expires.
These targets are business-days-only, and they are the honest ones for this mailbox. Our internal incident-response plan commits us to acknowledging a critical incident within 15 minutes. That target belongs to our automated alerting, which pages an engineer directly; it does not apply to email arriving at security@panluma.ai, which is read on business days. A report sent on a Friday evening is realistically read on the next business day. We would rather publish that plainly than advertise a response time this channel cannot meet.
Once a report has been read, our incident-response clock takes over — assessment, containment and remediation, and where personal data is involved the GDPR Article 33 notification within 72 hours, all measured from the point at which we became aware.
6. Recognition
PanLuma does not currently operate a paid bug-bounty programme. We will:
- Acknowledge valid, in-scope reports publicly on our Hall of Fame page (with researcher consent).
- Provide a written acknowledgement letter on request.
A formal bug-bounty programme is on our roadmap; this policy will be updated when it is launched.
7. Reporting Vulnerabilities in Third Parties
If you discover a vulnerability that affects a service PanLuma depends on (for example, an unpatched dependency or a misconfiguration in a sub-processor), please still report it to us. We will work with the upstream vendor and credit you for the coordination effort, even though the underlying fix is not in our code.
8. Contact
- Email: security@panluma.ai
- Web:
https://www.panluma.ai/.well-known/security.txt - Mailing address: provided on request to verified researchers.