Report responsibly

Email joshualabios92@gmail.com with the affected public URL, a concise impact description, safe reproduction steps, and a way to reply. Do not include credentials, tokens, personal data, or live exploit payloads.

Scope and safe harbor

Good-faith, non-destructive testing of LucyOS public web surfaces is welcome when it avoids privacy violations, denial of service, social engineering, automated account creation, payments, deliveries, data modification, persistence, and access beyond the minimum needed to demonstrate the issue. Research within these limits will not be pursued as malicious activity.

Response expectations

Receipt is normally acknowledged within five business days. Triage and remediation timing depend on severity, reproducibility, and third-party coordination. Please allow a reasonable fix window before public disclosure. No bounty or guaranteed resolution date is offered.