Find a bug.
Get the credit.
If you find a vulnerability in a LILY service or in the infrastructure that hosts user-deployed applications, tell us. Valid findings earn months of a paid plan and a place on the Wall of Fame.
What you can test
In scope
*.lilylabs.io
Every LILY service: platform, auth, docs and this site
*.lilylabs.app
The hosting infrastructure behind user-deployed services
Out of scope
- Third-party services we integrate with
- Social engineering or physical attacks
- Denial-of-service or volumetric attacks
- The code of user-deployed services themselves
Not considered a vulnerability
- Missing security headers without demonstrated impact
- Email spoofing, SPF, DMARC or DKIM issues
- Self-XSS
- Clickjacking on pages without sensitive actions
- Issues that need physical access or a rooted device
- Automated scanner output without manual validation
- Best-practice suggestions without security impact
- DoS, DDoS or rate-limiting issues
- Issues that only affect browsers more than two versions old
Rewards
Rewards land on your LILY account. The final tier depends on impact, report quality and how reliably the exploit works.
Critical
12 months of a paid plan, the Wall of Fame and a handwritten letter from the founders
Remote code execution, full account takeover, mass data exposure
High
6 months of a paid plan and the Wall of Fame
Privilege escalation, sensitive data leak, authentication bypass
Medium
3 months of a paid plan
Limited information disclosure, stored XSS, CSRF on sensitive actions
Low
1 month of a paid plan
Reflected XSS, minor information leak
Rules of engagement
- 1Test only against your own accounts and assets you control.
- 2Do not access, modify or destroy other users' data.
- 3Send clear reproduction steps. Exploit only as far as needed to show the issue.
- 4Give us reasonable time to fix it before you disclose, 90 days by default.
- 5The first reporter of a unique, valid finding gets the reward.
Safe harbor
Authorized
We consider security research done under this policy as authorized under sections 202a to 202c of the German Criminal Code.
No action from us
We will not pursue civil or criminal action against researchers who make a good-faith effort to follow it, avoid privacy violations and data exfiltration beyond what the issue needs, and report promptly without disclosing publicly before we have had a reasonable chance to respond.
Backing against third parties
If a third party takes legal action against you for research under this policy, we will make it known that your actions were authorized.
Reports are filed inside the platform
Sign in with Google or GitHub and open Feedback & Reports from the sidebar, or use the button below. Mark it as a security issue and add reproduction steps. We confirm receipt and keep you updated in the same thread.
Can't sign in? Email [email protected].
Wall of Fame
The first names go here once High or Critical findings are triaged.