At Lemony.ai, we take security seriously. If you discover a security vulnerability in any of our projects, please report it to us responsibly.
Please do NOT report security vulnerabilities through public GitHub issues.
Instead, please report them via email to:
Please include the following information in your report:
- Description: A clear description of the vulnerability
- Impact: The potential impact of the vulnerability
- Reproduction Steps: Detailed steps to reproduce the issue
- Affected Projects: Which Lemony.ai project(s) are affected
- Version: The version(s) of the software affected
- Proof of Concept: If applicable, include code or screenshots
- Initial Response: Within 48 hours of receiving your report
- Status Update: Within 7 days with our assessment and plan
- Resolution: We aim to resolve critical vulnerabilities within 30 days
We support safe harbor for security researchers who:
- Make a good faith effort to avoid privacy violations and data destruction
- Only interact with accounts you own or have explicit permission to access
- Do not exploit vulnerabilities beyond the minimum necessary to demonstrate the issue
- Report vulnerabilities promptly
- Keep vulnerability details confidential until we've addressed them
This security policy applies to all Lemony.ai projects, including but not limited to:
- CascadeFlow - AI model cascading library
- LemonyOS - On-premises AI platform
- Lemony Node - Hardware and related software
The following are generally considered out of scope:
- Social engineering attacks
- Physical attacks against Lemony.ai infrastructure
- Attacks requiring privileged access to user systems
- Denial of service attacks
- Issues in third-party dependencies (please report to the respective maintainers)
We appreciate the security research community's efforts. With your permission, we will:
- Acknowledge your contribution in our release notes
- Credit you in our security advisories (unless you prefer to remain anonymous)
This security policy may be updated from time to time. Please check back regularly for the latest version.
Thank you for helping keep Lemony.ai and our community safe!
For general questions about security at Lemony.ai, please contact: [email protected]