Security & Responsible Disclosure

Email security@lacnova.com with enough detail to reproduce the issue — the URL or endpoint, the steps, and what you were able to access.

We acknowledge reports within 2 working days, give an assessment within 10, and keep you updated until it is resolved.

• We will not pursue legal action against research conducted in good faith under this policy.
• We will credit you when the fix ships, unless you would rather stay anonymous.
• We will tell you when it is fixed, and agree a disclosure date with you.

• Use only your own account and test data.
• Do not access, modify or delete data belonging to anyone else.
• No denial of service, spam, social engineering or physical attacks.
• Give us reasonable time — normally 90 days — before publishing.

• Passwords hashed with bcrypt; never stored or logged in readable form.
• Short-lived access tokens with rotating refresh tokens, stored only as hashes.
• Reuse of a revoked refresh token signs out every session for that account.
• Input validated at the boundary, rate limits on every endpoint, and TLS everywhere.