Security Vulnerability Reporting and Bug Bounty Program

Vulnerability Disclosure

We value input from the security community that helps us protect our customers’ data. If you discover a potential vulnerability, we want to hear about it.

Focus Areas

We’re particularly interested in reports related to:

• Authentication bypass or privilege escalation

• Unauthorized access to data across workspace boundaries

• Injection attacks or remote code execution

In Scope

• The Lightfield web application and supporting services

• The Lightfield API

• Lightfield client SDKs

Out of Scope

• Automated scanning of any kind

• Social engineering, including phishing

• Denial of service attacks

• Attacks requiring physical access to a victim’s device

• Theoretical attacks without proof of exploitability

• Missing best practices in HTTP headers, cookies, TLS configuration, or DNS records on our marketing site

How to Report

Send your findings to security@lightfield.app with the following details:

• A summary of the issue and its potential impact

• Steps to reproduce, including any tools used

• Proof-of-concept code, if available

Our team will investigate and keep you updated on progress. We may follow up for additional details.

Responsible Conduct

We ask that researchers:

• Test only against their own accounts or with explicit permission from the account holder.

• Make a good-faith effort to avoid privacy violations, data destruction, or service disruption.

• Report the vulnerability to us before disclosing it publicly, and give us reasonable time to address it.

• Do not attempt to expand or elevate access beyond what is necessary to demonstrate the vulnerability.

• Comply with all applicable laws.

Safe Harbor

Research conducted in good faith under this policy is considered authorized. We will not pursue legal action against you for activities consistent with these guidelines. If a third party initiates legal action related to your research, we will take steps to make it known that your actions were conducted in compliance with this policy.

Common Questions