Security Policy

Reporting Security Issues

If you discover a security vulnerability in Lumi, please report it responsibly to security@lumi.media.

Do not open public issues or discussions for security vulnerabilities.

Security Contacts

• Primary Email: security@lumi.media
• Response Time: We aim to acknowledge reports within 48 hours and provide updates every 7 days until resolved.

Security.txt

Our vulnerability disclosure policy is published in machine-readable format per securitytxt.org:

Current security.txt fields include:

• Canonical for each app URL
• Preferred-Languages: en
• Encryption: https://explore.lumi.media/en/security/lumi-public.asc
• Policy: https://explore.lumi.media/en/security/

PGP Public Key

The security.txt files are cryptographically signed using the Lumi PGP public key.

Key Details

Verify Signatures

To verify the authenticity of our security.txt files:

# Download public key (to be published separately)
gpg --import lumi-security-pgp-public.asc

# Verify signature on security.txt
gpg --verify security.txt

Expected output:

gpg: Signature made [date] UTC
gpg:                using RSA key 895F9EC9191253F1
gpg: Good signature from "Lumi Co Pty Ltd <security@lumi.media>"

Vulnerability Handling Process

1. Report received → Acknowledged within 48 hours
2. Investigation → Severity assessment & reproduction
3. Fix development → Patch created & tested
4. Disclosure coordination → Coordinated release timeline
5. Public advisory → CVE/advisory published after fix is available

We request a reasonable embargo period (typically 30-90 days) to allow time to patch.

Additional Resources

• RFC 9110: HTTP Semantics (security.txt)
• securitytxt.org
• OpenPGP RFC 4880

Last Updated

2026-04-16