LemonSees is built and maintained by Altumptic. We take the security of a security product seriously — thank you for helping keep it safe.
Please do not open public GitHub issues for security problems. Report privately:
| Channel | Address |
|---|---|
| thefear078@gmail.com | |
| Telegram | @thefear078 |
| Policy | https://altumptic.com/security |
| security.txt | https://altumptic.com/.well-known/security.txt |
Encrypt sensitive reports with the Altumptic PGP key:
| Key | /.well-known/pgp-key.txt (also bundled at public/.well-known/pgp-key.txt) |
| Fingerprint | 117B A978 F332 80B5 12EE 84B5 D278 3C4F DE43 0CA6 |
| Type | Ed25519 / Cv25519 · expires 13 Oct 2028 |
Please include affected version, steps to reproduce and impact. We aim to acknowledge within 72 hours and to agree a disclosure timeline with you. Preferred languages: English, Ukrainian.
Every LemonSees instance also serves this contact information at /.well-known/security.txt.
| Version | Supported |
|---|---|
| 3.x | ✅ |
| < 3.0 | ❌ — please upgrade |
- The engine binds to
127.0.0.1by default. To expose the web UI on a network, set bothLEMONSEES_HOSTand a long randomLEMONSEES_TOKEN; without a token LemonSees refuses to bind publicly. - Put the web UI behind TLS (reverse proxy) and set
LEMONSEES_SECURE_COOKIE=1. - Prefer SSH keys over passwords; credentials are stored only on the machine running LemonSees.