Vulnerability disclosure
Security & disclosure
How to report a vulnerability to Altumptic: contact, PGP key, scope, timelines and safe harbor for good-faith research.
Report a vulnerability
- PGP key
- /.well-known/pgp-key.txt
- Fingerprint
117B A978 F332 80B5 12EE 84B5 D278 3C4F DE43 0CA6- Key type
- Ed25519 / Cv25519 · expires 13 Oct 2028
- Machine-readable
- /.well-known/security.txt
Please include the affected product and version, steps to reproduce, the impact you see, and how to reach you. Encrypt with the key above when the report contains exploit details. For a quick question before reporting, Telegram @thefear078 works — but send details only by email.
Scope
In scope
- altumptic.com
- Phobia Wallet — latest release
- LemonSees — latest release
Out of scope
- Denial of service, spam or load testing
- Social engineering and physical attacks
- Third-party services (GitHub, Cloudflare, Telegram)
- Scanner output without a working proof of concept
What you can expect
- Acknowledgement within 3 business days.
- A first assessment and severity within 10 business days.
- A fix or mitigation as fast as severity demands — normally within 90 days — with updates along the way.
- Public credit in the release notes, if you want it. There is no paid bounty yet.
Safe harbor
Good-faith research that follows this policy is authorized, and we will not pursue legal action over it. Good faith means: test only your own accounts and data, stop as soon as you reach anyone else's data, do not degrade the service, do not exfiltrate or keep more than you need to show the issue, and give us reasonable time to fix it before you publish.