Responsible Disclosure

1. Purpose#

Lobyco welcomes reports of security vulnerabilities in any service it builds or operates. Testing a customer commission follows Policy - External Security Testing instead.

Out of scope are our providers' services, our customers own systems, denial of service, social engineering, and findings with no demonstrated impact.

2. How to Report#

Email security@lobyco.com in English, with the affected service, steps to reproduce and the impact. Mark critical issues URGENT. Never include personal data, credentials or payment card data.

3. Rules#

• Use only your own accounts and data, and test only as far as you need to prove the issue.

• Do not disrupt the service, change data, or transact on real member accounts.

• If you reach someone else's data, stop, tell us at once, and delete it when we ask.

• Keep the details private until the fix is live or 90 days have passed, whichever comes first.

• Do not ask for payment in return for the details.

4. What Lobyco commit to#

We confirm receipt within 3 business days, give our assessment within 10, and update you at least every 30 days until it is fixed. With your consent we credit you once it is fixed. We do not pay bounties.

5. Safe harbour#

If you follow this policy in good faith, Lobyco will not take legal action against you or report you to the police. We will confirm this to any third party who asks. We can only authorise testing of systems Lobyco controls, and testing that breaks the rules outlined is treated as an unauthorised attack.