Skip to main content
Use the channel that matches the surface and the sensitivity of the report. Lasso is an early product and project. Public support is currently best-effort. There is no general response-time, restoration-time, uptime, or advance-notice commitment unless you have a separate written agreement.

​
Get help or report a problem

GitHub issues are an asynchronous support channel. They are not an emergency pager. Do not post Lasso keys, cookies, provider URLs, provider credentials, billing details, database connection strings, or personal data. If a public report needs sensitive evidence, first open a redacted issue asking for a private handoff path. For a Cloud availability check, inspect /api/health and /agent.json. Process health establishes only the checks reported by that response. It does not prove that a particular chain, provider, method, historical query, or subscription is working. Lasso does not currently publish a separate public status page or a contractual incident-response target. During an incident, keep the previous RPC endpoint or self-hosted deployment available as an application rollback when your workload requires that option.

​
Report a security vulnerability

Do not use a public issue for a suspected vulnerability in Lasso Cloud or RPC Core. Email jaxernst@gmail.com. This is also the private reporting channel in the current RPC Core security policy. Include enough detail to reproduce and assess the report, but do not send active production credentials unless a separate secure exchange has been arranged. The current policy does not promise a response or disclosure deadline. Confirmed issues are investigated, fixed, and disclosed on a timeline coordinated with the reporter when practical. For operating guidance, see the Core security considerations and production checklist. RPC Core has no built-in client authentication or incoming customer quotas. Protect its RPC, metrics, and dashboard endpoints at your network or reverse proxy.

​
Versions and lifecycle

​
RPC Core

RPC Core supports the latest published release with security updates. Upgrade older versions before deploying them or requesting a security fix. The project is pre-1.0, so review the target release’s compatibility section before every upgrade instead of assuming that all minor releases are interchangeable. Use a versioned GitHub release and its recorded container digest for production. Repository main, a moving container tag, and the separately deployed Cloud service can contain different code. Release notes state known configuration, storage, migration, and rollback boundaries. See Versions, availability, and evidence. There is no published long-term-support branch, backport window, or fixed release cadence today. Older releases remain available as historical artifacts, but their availability does not mean they receive fixes.

​
Lasso Cloud

Cloud is a continuously deployed managed service. Check the live /openapi.json for request contracts and /agent.json for advertised capabilities before automation. A route present in source or documentation can still be disabled in the deployed service. There is no general public deprecation-notice window or fixed Cloud release cadence today. Preserve the request and response behavior your integration depends on, keep a rollback path, and recheck the live contracts during qualification and before expanding traffic.

​
Repository and license boundaries

The live Cloud service, the latest Core release, and repository main are separate evidence surfaces. When evaluating behavior, record which one you tested, its reported source or version, the time, region, route, and workload.