Security Policy

Reporting Vulnerabilities

Please do not open public issues for security vulnerabilities. Report issues privately so we can triage and respond without exposing users to additional risk.

• Email security concerns to security@lyralinkai.com
• Include a clear description, reproduction steps, impact, and any suggested mitigation
• If email is unavailable, use a private GitHub Security Advisory

Secret Handling

We avoid committing credentials, API keys, or tokens to the repository and expect operators to use environment variables for deployment secrets.

• Rotate any leaked secrets immediately
• Use least-privilege access for services and infrastructure
• Keep security updates on the current maintained branch

Defense Controls

Lyralink uses HTTPS, session controls, rate limiting, verification safeguards, and logged security events to protect account access and platform integrity.

Security-sensitive actions are gated by server-side checks, and operator workflows are audited where appropriate.

Contact