How to report
Email [email protected]. Include the affected version (Settings › About), steps to reproduce, expected and actual results, and a proof of concept if you have one. Please don’t send personal data (other people’s recordings, license keys).
Scope
In scope: the LungType app (latest version), lungtype.com, the account service at api.lungtype.com and the update feed (appcast).
Out of scope: third-party services such as Lemon Squeezy, Hugging Face and Anthropic (report to their own programs); denial of service; social engineering; physical access; attacks that already require administrator rights; outdated operating system versions; automated scanner output without demonstrated impact.
Response times
We acknowledge within 3 business days and share an initial assessment within 10 business days. We fix confirmed issues by severity, aiming for 30 days for critical issues and 90 days for others.
Coordinated disclosure
Please keep details private until a fix is released or 90 days have passed since your report, whichever comes first. We can agree on an extension.
Good-faith research
If you follow this policy and test only on your own device and your own account, we won’t take legal action against you. Don’t access, change or delete other people’s data, and don’t disrupt the service.
Thanks
We don’t run a bug bounty. With your permission we’ll credit you on this page.
Last updated: 16 October 2026