Bug Bounty Policy

Lokad rewards the responsible disclosure of security vulnerabilities. The typical range of a bounty is 50€ to 2000€, with the amount determined by the severity of the reported vulnerability. Please note that bounty decisions are up to the discretion of Lokad. Issues may receive a lower severity due to the presence of compensating controls and context.

Every issue report must indicate the real name and physical address of the security researcher issuing the report. If the security researcher operates on behalf of a company, then the address must, instead, be the one of the headquarters of the company. We will not investigate the validity of reported issues until we have received those elements. Later on, bounty payments - if any - will be required to match those elements.

Due to a large influx of incorrect reports, Lokad may not be able to respond at all to reports concerning issues that are not exploitable vulnerabilities. Repeated submissions or reminders can lead to the reporter’s address being blocked.

The most significant bounties are restricted to the app accessible from go.lokad.com, referred to as our core app.

If our core app is not impacted, any bounty will be at the low end of the typical range.

This policy does not constitute permission to subject Lokad’s software to penetration testing, or to attacks that could threaten its security or availability. Its purpose is to encourage responsible disclosure of issues observed during normal use of the system.

Any vulnerability caused by a lowered security level (ex: using passwords instead of SAML, disabling session IP validation, relying on insecure channels like emails) is a “Business Accepted Risk” and is not eligible for a bounty. All non-compliance to generic but non-exploitable (best) practices are also “Business Accepted Risk”.