Security Disclosure
Reporting vulnerabilities responsibly
The LSN Foundation welcomes responsible reports of security vulnerabilities affecting Foundation-controlled websites and public infrastructure.
This page explains the appropriate reporting route, the current scope of the Foundation's disclosure process, and the distinction between Foundation infrastructure and independently operated ecosystem systems.
Report a Vulnerability
Security Reports
If you believe you have identified a security vulnerability affecting lsn.foundation or other Foundation-controlled public infrastructure, please report it privately to the Foundation.
Email: security@lsn.foundation
Please identify the message clearly as a security report and include enough information for the Foundation to understand and reproduce the issue where reasonably possible.
What to Include
A useful vulnerability report should provide clear information about the affected system and the issue observed without including unnecessary personal, confidential, or third-party information.
Affected resource. Identify the domain, page, endpoint, resource, or service affected by the issue.
Description. Explain the vulnerability and the conditions under which it can be observed.
Reproduction. Provide concise steps that allow the issue to be reproduced where doing so is safe and practical.
Potential impact. Describe the security consequence you believe could result from the vulnerability.
Supporting information. Include relevant technical details or evidence necessary to understand the report while avoiding unnecessary sensitive data.
Scope
Foundation-Controlled Infrastructure
This disclosure process applies to security issues affecting websites and public infrastructure operated or controlled by the LSN Foundation.
This includes the public Foundation website at lsn.foundation and Foundation-controlled resources served through that domain.
Independent Ecosystem Infrastructure
The wider Lattice Semantic Nexus includes structurally distinct components. Infrastructure operated independently by another ecosystem component is not automatically within the scope of the Foundation's security disclosure process.
Vulnerabilities affecting an independently operated service should be reported through the security or contact channel published by the operator of that service.
Responsible Security Research
Security investigation should be conducted carefully and in a manner that avoids unnecessary disruption, harm, or access to information beyond what is reasonably necessary to identify and describe a potential vulnerability.
Avoid disruption. Do not intentionally degrade, disable, overload, or materially interfere with Foundation services.
Minimise access. Do not access, modify, retain, or disclose data beyond what is reasonably necessary to demonstrate the existence of an issue.
Protect third parties. Avoid activity that compromises the privacy, security, or accounts of other users or organisations.
Report privately. Give the Foundation an opportunity to understand and address a security issue before publishing technical details that could materially increase risk.
Stay within the identified system. Discovery of an issue does not provide permission to expand testing into unrelated systems or third-party infrastructure.
Disclosure Is Not General Authorisation
Security Testing Boundary
Publication of this security disclosure page should not be interpreted as blanket authorisation to access systems, accounts, data, administrative interfaces, or infrastructure without permission.
Researchers remain responsible for ensuring that their activity complies with applicable law and does not exceed the access or testing authority available to them.
Sensitive Information
If a vulnerability unexpectedly exposes personal, confidential, authentication, or other sensitive information, stop accessing the affected information once sufficient evidence has been obtained to identify the issue.
Do not unnecessarily copy, retain, redistribute, or publicly disclose exposed information. The security report should describe the type of information affected without reproducing sensitive content unless doing so is necessary for the Foundation to understand the issue.
Public Disclosure
Responsible disclosure allows time for a reported vulnerability to be investigated and, where necessary, addressed before detailed information is made public.
Researchers considering public disclosure are encouraged to communicate with the Foundation first so that relevant security risks can be understood and remediation can be considered.
The existence of this process does not require a researcher to transfer ownership of independently created research or prevent lawful discussion of security issues. Its purpose is to support coordinated handling of vulnerabilities that could create ongoing risk.
Handling Security Reports
Assessment
Reports received by the Foundation may be reviewed to determine whether the issue affects Foundation-controlled infrastructure and whether further investigation or corrective action is required.
Additional information may be requested where the original report does not provide enough detail to understand or reproduce the issue.
Remediation
Where a security issue is confirmed, the appropriate response will depend on the nature of the vulnerability, the affected infrastructure, and the practical steps available to reduce or remove the identified risk.
This page does not establish a guaranteed response time or remediation period.
Vulnerability Rewards
The publication of this disclosure process does not establish a vulnerability bounty or paid security research programme.
Unless the Foundation separately publishes such a programme, researchers should not assume that a report creates an entitlement to payment, reward, compensation, or other consideration.
security.txt
Machine-Readable Disclosure Information
The Foundation publishes machine-readable security contact
information using the standard security.txt
location for the domain.
This provides automated tools and security researchers with a predictable location for finding the Foundation's current security disclosure information.
Canonical Location
The machine-readable record should be read together with this human-readable security disclosure page.
Website Security & Lattice Core
A vulnerability affecting the Foundation website or its supporting web infrastructure should not automatically be interpreted as a vulnerability in the Lattice Core architecture itself.
Lattice Core is an architecture. The Foundation website is a public institutional and documentary surface. Security issues should therefore be identified according to the system and authority domain in which they actually occur.
Likewise, a security issue in a downstream implementation does not by itself establish a defect in the underlying architecture, standards, conformance requirements, or detailed specification. Architecture, standards and conformance, detailed specification, and implementation are distinct levels and should be assessed according to the source responsible for each.
Changes to This Disclosure Process
The Foundation may update this security disclosure information as its websites, infrastructure, security practices, or reporting channels develop.
The version published on this page represents the current public security disclosure information for the LSN Foundation website.
Security Contact
Report an Issue
Potential security vulnerabilities affecting Foundation-controlled infrastructure can currently be reported through:
Please identify the communication clearly as a security report.
General Enquiries
Questions that are not security reports can be directed through the Foundation's general contact information.
Legal Directory
Privacy
Privacy information relating to the Foundation website and applicable public services.
Licensing
Information concerning licensing and reuse of applicable Foundation-controlled and Foundation-distributed material.