Vulnerability Disclosure Policy

Last updated July 14, 2026

Librarian, Inc. ("we", "us") is committed to the security of our customers, partners, staff, and the broader Internet community. We welcome reports of potential security vulnerabilities and follow a coordinated disclosure process to remediate issues efficiently.

1. Scope

In scope:

• thelibrarian.io and any subdomain (e.g., chat.thelibrarian.io)
• The Librarian mobile applications (iOS, Android)
• The Librarian browser extensions
• Backend APIs and infrastructure operated by Librarian, Inc.

Out of scope:

• Social engineering attacks against Librarian, Inc. employees, contractors, or customers (e.g., phishing).
• Physical attacks on Librarian, Inc. facilities or assets.
• Denial-of-service (DoS / DDoS) attacks or volumetric testing.
• Vulnerabilities in third-party services we use (please report those to the vendor).
• Findings from automated scanners without a demonstrated impact.
• Self-XSS, missing security headers without exploitability, and other low-severity issues.

2. How to report

Email reports to security@thelibrarian.io. Please include:

• A clear description of the vulnerability and its impact.
• Steps to reproduce, including any required configuration.
• Proof-of-concept code or screenshots, where applicable.
• Your name and contact details (for credit and follow-up).

Where possible, please use the Common Vulnerability Scoring System (CVSS) to estimate severity. If your report concerns a sensitive matter, you may request that we use PGP - contact us first to exchange keys.

3. Our commitments to you

When you report a potential vulnerability in good faith:

• Acknowledgment: We will acknowledge receipt of your report within 5 business days.
• Investigation: We will investigate the report, work with you to understand it, and keep you informed of progress.
• Remediation: Where a vulnerability is confirmed, we will provide a target remediation timeframe based on severity.
• Disclosure: We will notify you when the vulnerability has been resolved, allow retesting if requested, and reference you in the release notes (unless you prefer to remain anonymous).
• Safe harbor: We will not pursue legal action against researchers who report vulnerabilities in good faith, comply with this policy, and avoid harm to our users or services.

4. What we ask of you

We rely on responsible disclosure to keep our users safe. Please:

• Give us a reasonable period to investigate and remediate before publicly disclosing the issue (typically 90 days; we may agree to shorter timeframes for low-impact issues or longer for complex remediations).
• Do not access, modify, or delete data belonging to others.
• Do not perform actions that degrade service or affect other users (e.g., automated scans, brute-forcing, denial-of-service).
• Do not attempt to social-engineer our employees, contractors, or service providers.
• Do not test against our employees' personal accounts.

5. Rewards

We do not currently operate a paid bug-bounty program. We will publicly acknowledge confirmed reporters (with consent) in our release notes or a security acknowledgments page.

6. Governance

This policy is owned by the senior management team of Librarian, Inc. and reviewed at least annually. Day-to-day staff are trained on this policy and the associated response procedure.

7. Contact

Vulnerability reports: security@thelibrarian.io Privacy questions: privacy@thelibrarian.io General support: support@thelibrarian.io

Postal: Librarian, Inc., 720 Seneca St Ste 107 PMB 79, Seattle, WA 98101, United States