Security Researcher Acknowledgements
Effective 2026-08-17 · Version 1.0Our Vulnerability Disclosure Policy does not pay for reports. What it offers instead is credit, and this is the page that credit appears on. It is published for one reason: a recognition-only program in which the recognition is not actually published is not a program, it is a way of asking for free work.
The list
No one is listed yet, and we would rather say so than leave this page unpublished. As of the effective date above we have not received and resolved a report that met the criteria below. The page exists from the start so that the first person who sends one is not waiting on us to build the thing we already promised — and so that you can see, before you spend an evening on our attack surface, exactly what you would be getting.
When we add you
We will add an entry when all four of these are true:
- You reported the issue to security@lonzo.ai and stayed within the scope and rules of the Vulnerability Disclosure Policy.
- The issue was real, previously unknown to us, and specific enough to act on.
- We have fixed or mitigated it — we do not publish an acknowledgement while the underlying issue is still exploitable, because the acknowledgement is itself a hint.
- You asked to be credited. Credit is opt-in. If you say nothing, we say nothing.
We will email you the exact wording of your entry before it appears here, so that the first time you see how you are described is not on a public page. If we cannot reach you at the address you reported from, we hold the entry rather than guessing.
What an entry contains
- The name or handle you asked for, and one link if you gave us one (your site, profile, or research page).
- The month the report was resolved.
- A one-line description of the class of issue — enough to show what you found, never enough to reproduce it.
We do not publish your email address, your report, or the technical detail of the finding. If you later want your entry changed or removed, write to security@lonzo.ai and we will do it; a credit you no longer want is not a credit.
What this is not
- It is not payment. There is no bug bounty, no monetary reward, and no swag. The Vulnerability Disclosure Policy says this too, and this page repeats it so that neither can be read as implying the other.
- It is not a ranking. There are no points, tiers, or leaderboards. Entries are listed in the order they were resolved.
- It is not a condition of the safe harbor. The authorization and the covenant not to sue in the disclosure policy apply to good-faith research whether or not you want to be named, and whether or not we ever list you.
Finding this page from a machine
Our RFC 9116 security contact file at /.well-known/security.txt names this page in its Acknowledgments field, alongside the reporting address and the policy. If your tooling reads that file, it can find both the terms and the credit without a human in the loop.
Questions: security@lonzo.ai · Vista del Lago Software LLC