Vulnerability disclosure policy

Version 2026-10-31. Last updated: October 31, 2026.

We want to hear about security problems in Lantern. If you think you have found one, please tell us.

How to report

Email support@lanternnms.com with Security at the start of the subject line. Include what you found, where (the URL, release version or component), the steps to reproduce it, and what an attacker could do with it. Please do not include other people's personal data. Our contact details are also published in security.txt.

What we do

  • We confirm that we received your report within 3 business days.
  • We look into it, keep you updated, and tell you when it is fixed.
  • We fix confirmed vulnerabilities as fast as their severity calls for, and publish the fix in a new release or deploy it to the cloud service.
  • If you want, we credit you in the release notes once the fix is out.
  • We do not offer payment for reports at this time.

Rules for good-faith research

You may test for vulnerabilities in a copy of the Lantern appliance that you run yourself, and in your own Lantern account and cloud portal. When you do:

  • do not access, change or delete other customers' data, and stop and tell us if you come across any;
  • do not test other customers' portals, and do not run denial-of-service, load or volume tests against our service;
  • do not use social engineering, phishing or physical attacks against our staff or customers;
  • do not use automated scanners against lanternnms.com, account.lanternnms.com or collect.lanternnms.com beyond what is needed to confirm a finding;
  • give us reasonable time to fix the problem before you tell anyone else about it; we ask for 90 days, and will agree a date with you.

If you follow these rules in good faith, we will consider your research authorized under our Acceptable Use Policy, we will not pursue legal action against you for it, and if someone else does, we will make it known that you acted with our authorization. This does not authorize testing of systems that belong to others, such as our hosting providers or our customers' networks.

Out of scope

Reports about missing security headers without a demonstrated impact, about email settings such as SPF or DMARC policy alone, or that need a compromised device or browser, are welcome but usually not treated as vulnerabilities.