Lacuna Vulnerability Disclosure

generated: '2026-09-11'
method: searched
probe: true
source: https://www.lacuna.fm/.well-known/security.txt
published: true
standard: RFC 9116
contact:
  - mailto:support@lacuna.fm
document:
  url: https://www.lacuna.fm/.well-known/security.txt
  http_status: 200
  content_type: text/plain
  file: ../well-known/lacuna-security.txt
  fields_present: [Contact, Expires, Preferred-Languages, Canonical]
  fields_absent: [Policy, Acknowledgments, Encryption, Hiring, CSAF]
  expires: '2027-09-11T20:58:44.990Z'
  self_maintaining: true
  expiry_note: >-
    The Expires value rolls forward — it read 2027-08-09 on 2026-08-09 and 2027-09-11 on 2026-09-11, so
    it is computed rather than hand-set. The document will therefore never lapse into the stale state
    that makes most published security.txt files worthless, which is a genuinely uncommon property.
grade: contact-only
assessment: >-
  Lacuna publishes a valid, live, self-refreshing RFC 9116 security.txt with a working contact address,
  and that is the whole of its disclosure posture. There is no `Policy` field, so no disclosure terms,
  scope, or safe-harbour statement is published; no `Acknowledgments` field, so no researcher credit;
  and no PGP key for encrypted reports. A researcher knows where to send a report and nothing about what
  happens next.
bug_bounty:
  exists: false
  platforms_checked: [HackerOne, Bugcrowd, Intigriti]
  result: no programme found on any platform
  checked: '2026-09-11'
disclosure_policy:
  published: false
  probed:
    - {url: 'https://www.lacuna.fm/security', status: 404, checked: '2026-09-11'}
    - {url: 'https://trust.lacuna.fm/', status: 0, note: 'DNS does not resolve', checked: '2026-09-11'}
  note: >-
    The public legal surface is Terms of Service, Privacy Policy, Commercial License and Community
    Guidelines. None of them describes vulnerability reporting or handling.
credential_compromise_path:
  documented: true
  instruction: 'Report abuse or credential compromise to support@lacuna.fm'
  source: https://www.lacuna.fm/auth.md
  note: >-
    auth.md closes with an explicit credential-compromise route, which is the agent-relevant half of
    this posture — an autonomous client that leaks a lyr_live_ key is told where to report it, and the
    account holder can revoke immediately at /profile/api or, for OAuth tokens, over the wire at
    POST /oauth/revoke (RFC 7009).
gaps:
  - No Policy field in security.txt — no published disclosure terms, scope, or safe harbour.
  - No bug bounty or coordinated-disclosure programme.
  - No PGP/Encryption key for sensitive reports.
  - No trust centre and no published certifications (see conformance/lacuna-conformance.yml compliance_program).
x-evidence:
  fetched: '2026-09-11'
  urls:
    - {url: 'https://www.lacuna.fm/.well-known/security.txt', http_status: 200}
    - {url: 'https://www.lacuna.fm/security', http_status: 404}
    - {url: 'https://www.lacuna.fm/auth.md', http_status: 200}