Security at lablab.ai
Security policy
How to report a security vulnerability in lablab.ai — where to send it, how we handle it, what is out of scope, and why we do not pay for reports.
Last updated 2026-09-22
Reporting a vulnerability
Email [email protected]. This address is also published in our security.txt. Please do not open a public issue, post the finding in our Discord, or report it through a community channel.
Include in your report
- The affected URL, endpoint, or page, and the account or role you were signed in as.
- The steps to reproduce it, in order, including any request body or payload you sent.
- What an attacker could actually do with it — the impact, not just the observation.
- Anything you need us to know to reproduce it safely, such as a test account you created.
Rules of engagement
- 1
Test only against your own data
Use accounts you created yourself. Do not access, modify, or retain another person's data, and stop as soon as you have confirmed a vulnerability exists — you do not need to prove how far it goes. If you access personal data by accident, tell us in the report and delete it.
- 2
Do not degrade the service
No denial-of-service testing, no load or stress testing, and no automated scanning that generates enough traffic to affect other users. Do not attempt physical attacks, social engineering of our staff, community, or vendors, or any attack against a third-party service we happen to use.
- 3
Give us a reasonable chance to fix it
Keep the report private until the issue is resolved. We will not take legal action over good-faith research that follows this policy, and we will work with you on timing if you intend to write the finding up afterwards.
- 4
What happens after you report
We aim to acknowledge reports within five working days. If the issue is valid and in scope we will tell you once it is fixed. We may not reply in detail to reports that are out of scope, unreproducible, or already known, and we do not provide status updates on request.
We do not pay for vulnerability reports
lablab.ai does not operate a bug bounty programme and offers no payment, bounty, or reward for security reports — including reports we act on. We will not negotiate a payment after a report has been sent, and submitting one creates no expectation of compensation. What we do offer is a fix.
Out of scope
We are unlikely to act on the following, and may not reply to a report that contains only these:
- Raw output from an automated scanner with no demonstrated impact.
- Missing security headers, cookie flags, or TLS configuration preferences, absent a working exploit.
- SPF, DKIM, or DMARC policy observations, and email spoofing that our mail provider already blocks.
- Self-XSS, or any issue that requires the victim to paste attacker-supplied content into their own console.
- Clickjacking on pages with no state-changing action, and missing rate limits on unauthenticated read-only endpoints.
- Software version disclosure, banner grabbing, and public directory listings that contain no private data.
- Vulnerabilities in third-party services we do not operate — report those to the service concerned.
- Issues that require a rooted device, a malicious browser extension, or a compromised account to exploit.