LoginRadius Bug Bounty Program

The LoginRadius Bug Bounty program is to improve the LoginRadius’s cybersecurity posture through formalized community involvement. No technology is perfect, and LoginRadius believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology.

If you believe you’ve found a security issue in our product or service, we encourage you to notify us. Subject to the terms below, the Information Security Department is offering rewards for the responsible discovery and disclosure of system vulnerabilities.

Disclosure Policy

  • Let us know as soon as possible upon discovery of a potential security issue, and we’ll make every effort to quickly resolve the issue.
  • Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep LoginRadius and our users safe.

Scope of Bug Bounty Program

The LoginRadius.com websites secure.loginradius.com, www.loginradius.com, api.loginradius.com are all within scope. The accepted categories include injection attacks, authentication or authorization flaws, cross-site scripting, sensitive data exposure, privilege escalation, and other security issues.

Exclusions / Out of Scope

While researching, we’d like to ask you to refrain from:

  • Denial of service (DOS) attacks
  • Spamming
  • Automated Scan Report
  • Social engineering (including phishing) of LoginRadius staff or contractors
  • Deprecated Browsers and/or Systems
  • Any physical attempts against LoginRadius property or data centers

Reward

Bug Bounty program rewards are at the sole discretion of LoginRadius’ InfoSec team.

  • The minimum reward for eligible bugs is the equivalent of $50 USD.
  • Rewards over the minimum are at our discretion, but we will pay significantly more for particularly serious issues, i.e. that the identified issue could put a significant number of users at risk of severe damage, monetary or otherwise.
  • Each bug will only be considered for a reward once.

Get Started

Bug Bounty program rewards are at the sole discretion of LoginRadius’ InfoSec team.

  1. Find a security issue: Locate a security bug/issue on the LoginRadius website, the customer portal, or with our API.
  2. Write to us: Create a report, including steps to reproduce the bug/issue, and attach additional evidence if needed.
  3. Receive a reward: The higher the severity of the bug, the higher the value of the reward.

Report a Security Bug

  • Send your bug report to security@loginradius.com
  • Try to include as much information in your report as you can, including a description of the bug, its potential -impact, and steps for reproducing it or proof of concept.
  • Include your name, email address, and Country information.
  • Please allow 5 business days for us to respond before sending another email.