Legal
Vulnerability disclosure policy
How to report a security vulnerability, what's in scope, and what to expect from us.
At Lovd, we take security seriously. We appreciate the security research community and believe in responsible disclosure of security vulnerabilities.
Reporting a vulnerability
If you believe you've discovered a security vulnerability in our systems, please follow these steps:
- Email us at mike@lovd.app with a detailed description of the vulnerability.
- Include steps to reproduce the issue.
- Provide any proof-of-concept code, if applicable.
- Allow us reasonable time to respond and address the issue before public disclosure.
Our commitment
When working with us, you can expect:
- Acknowledgement of your report within 48 hours.
- Regular updates on the progress of your report.
- Recognition for your contribution (if you'd like it).
- Protection from legal action when you follow this responsible disclosure policy.
On bug bounties: We don't respond to requests for a bounty, as we're still a small company. We deeply appreciate every responsible report, and once we're more established we'd love to back-pay researchers with a Lovd T-shirt.
Scope
This policy applies to all Lovd products and services, including:
- Our web applications and APIs
- Mobile applications
- Infrastructure components
Out of scope
The following are not considered valid vulnerabilities under this policy:
- Denial-of-service (DoS) attacks
- Spam or social engineering attacks
- Physical security attacks
- Third-party applications or websites
