Security

Report a vulnerability

security@lake8.dev — encrypted reports preferred.

PGP key and fingerprint: /security/pgp/

Response times:

• Every report: acknowledgment within 7 days, assessment within 21 days. The assessment is what assigns the severity.
• High and Critical: fix within 90 days of the assessment.
• Medium and Low: best-effort, with status updates, until the public launch (April 2027). We will revisit this as we go.
• Scale: Critical / High / Medium / Low — the same scale as the August red team report. We do the classification, and you are free to contest it.
• Applies to reports received from 29 September 2026. Findings already published in the August report (F-001-REV, F-ISO, F-003) keep the fix timeline declared there.

---

Security programme

• Vulnerability Disclosure Policy — scope, safe harbour, coordinated disclosure
• Product Security Incident Response — severity classification, response process, known accepted risks
• Beta Red Team — Rules of Engagement — perimeter, safe harbour and reporting rules for developer beta participants
• The extraction challenge — pull the identity seed off a Flash-Encryption-RELEASE chip: a separate exercise, on the dongle in your own hand, with its own scope and safe harbour

---

Public finding register

All findings — open and closed — are published at /security/red-team-2026-08/

---

Known open findings

ID	Severity	Description	Fix
F-001-REV	High	Session binding not implemented	Q2 2027
F-ISO	Medium	Block-cipher accumulator not bound to a handle — fail-closed	Q2 2027
F-003/B1	Low	PIN in cleartext over USB HID	Q2 2027