Responsible disclosure
Do not publish suspected vulnerabilities, credentials, private infrastructure details, or exploit material in a public issue.
For initial contact, email Kevin@luvion.dev with the subject Security report and a non-sensitive summary of the affected component and impact. Do not send credentials, customer data, or a full exploit in the initial email. Request an agreed secure channel for sensitive details. Existing partners may also use their established private contact. A dedicated encrypted intake channel and response-time SLA have not been announced.
Include, when safe:
- affected component and version or commit;
- concise impact and preconditions;
- reproducible steps using test assets only;
- relevant request IDs, logs, or evidence digests with secrets removed; and
- whether the issue may be actively exploitable.
Luvion will acknowledge receipt through the same private channel, preserve the report as restricted information, and coordinate validation and remediation before any disclosure. A formal response-time policy will be published before production onboarding.
The current pilot has no public bug-bounty program and no production-value authorization scope. Do not test against systems or assets without explicit written permission.