Guidelines

• • Please provide a detailed report with reproducible steps.
• • Only provide reports that have clear and important security implications. Not all product quality issues are vulnerabilities.
• • Please provide sufficient time before reporting recently discovered CVEs or outdated dependency versions. We regularly scan for new CVEs, but releasing new versions takes time to provide sufficient quality control.
• • We are especially interested in reports related to:
  • - Remote code execution
  • - SQL injection
  • - Cross-organization privilege escalation
  • - Data breaches
  • - Exploitable SSRF (ie. blind SSRF leading just to a pingback is excluded)
  • - Stored XSS
• • Following reports are out-of-scope of our program:
  • - Clickjacking, reverse tabnabbing
  • - Phishing via user-generated content (eg. notification e-mails, dashboard sharing)
  • - CORS configuration
  • - Pre-Auth Account takeover/OAuth squatting
  • - Disclosure of Luzmo API tokens of third parties -- you can report these, but we will not award points
  • - Bugs without clear security impact, eg. missing rate-limits/security headers/cookie flags, best practices violations, autocomplete, self-XSS, version disclosure, disclosure of API keys meant to be public, etc.
• • Luzmo allow security testing of its services for the purpose of responsible disclosure. Please do not abuse found vulnerabilities. Please do not use automated scanning tools that exceed the rate limits (10 req/s). We will ban abusers and reserve the right to take further steps in case of repeated abuse.
• • To thank you for your submissions, we'd love to publish your name in our security leaderboard andsend you an official Luzmo swag package upon reaching 15 points worth of accepted vulnerabilities. Please provide your address in the submission form if you want to participate in this. We only process your address for the purpose of sending you a swag package.
• • Leaderboard points are awarded for validated, accepted submissions. Duplicate submissions are rewarded with half points. Points are awarded by final severity of the finding:
  • - Critical finding: 50 points
  • - High severity finding: 25 points
  • - Medium severity finding: 10 points
  • - Low severity finding: 5 points