Reporting a security issue

How to reach us

Email contact@lahja-ai.com. Include what you found, how to reproduce it, and what you think the impact is. If a request id is involved, quote it — it is the fastest way for us to find what happened.

What happens next

• We acknowledge your report within three working days.
• We tell you whether we have reproduced it, and what we intend to do, within ten working days.
• We will tell you when it is fixed, and we are happy to credit you if you would like that.

These are commitments about our response, not about a fix timeline — how long a fix takes depends on what it is, and promising a number we might not meet would be worse than not promising one.

Scope

The LAHJA AI web application and its public API.

What we ask you not to do

• Do not run automated scanners or load tests against the production service. This platform holds contributors’ voice recordings and client data; a scan that degrades it affects real people’s work and pay.
• Do not access, modify or download data belonging to anyone other than an account you control. If you find a way to, stop there and tell us — that is the finding.
• Do not use social engineering against our staff or contributors.
• Do not publish a finding before we have had a chance to fix it.