Vulnerability disclosure policy
Updated 23 October 2026
We welcome reports from security researchers. Use the security report form, or write to the contact form, with what you found and how to reproduce it. The LazyFrog support team replies by email, and reports to the security address are also flagged for the founder.
In scope
lazyfrog.dev and its subdomains, the MCP gateway, the portal, and the isolation between projects on lazyfrog.app.
Rules
- Test only against your own account and projects.
- Don't access, change or delete other people's data; if you reach some by accident, stop and tell us.
- Don't degrade the service: no denial-of-service, spam or social engineering.
- Give us reasonable time to fix a problem before you make it public.
Our commitments
- We confirm we've received your report and keep you informed until it is fixed.
- We won't take legal action against research done in good faith under these rules.
- With your permission, we'll credit you when the fix is announced.
A paid bounty will follow once LazyFrog can fund one.