Ready up
Draft, pending legal review. This document has not been reviewed by counsel and is not yet in effect.

Legal

Security Research Policy

Version 0.1-draft. Effective date: [TODO: effective date].

We welcome reports from security researchers. This policy explains how to report a vulnerability in lobbylabs.net, what you may test, and the legal protection we give researchers who follow it. Our machine-readable contact details are in /.well-known/security.txt.

1. How to report

Email security@lobbylabs.net with:

  • a description of the vulnerability and its potential impact;
  • the affected URLs and step-by-step instructions to reproduce it;
  • any proof-of-concept code, screenshots, or logs; and
  • how you would like to be credited, if at all.

We will acknowledge your report within 5 business days, keep you informed as we work on it, and tell you when it is fixed. With your permission, we will credit you. We do not currently offer payment for reports.

2. Scope

In scope: the website at lobbylabs.net, including the early-access signup form.

Out of scope:

  • social engineering, phishing, or any attempt to deceive our team, contractors, or users;
  • physical attacks against people, offices, or equipment;
  • denial of service, load testing, or any testing that degrades the site for others;
  • third-party services we use, such as Cloudflare, our email provider, and code hosting platforms (report issues in those services to their owners under their own policies);
  • the Lobby product, SDKs, hosted services, and open-source code, which will have their own security policies (for open-source code, follow the policy in the repository, or email us if it has none); and
  • reports without a demonstrated security impact, such as missing security headers, email authentication (SPF, DKIM, DMARC) settings, version disclosure, clickjacking on pages with no sensitive actions, self-XSS, or unverified output from automated scanners.

3. Rules

  • Do not access, modify, or delete data that is not yours. If you come across personal data, stop, do not copy or keep it, and tell us right away.
  • Do not destroy or corrupt data, or degrade the site for others.
  • Do not run high-volume automated scans. Submit the signup form only with email addresses you control, and only as often as needed to show the issue.
  • Use only the minimum testing needed to demonstrate the vulnerability.
  • Give us 90 days from your report to fix the issue before disclosing it publicly, unless we agree on a different date in writing. Coordinate the disclosure with us.
  • Do not demand payment or other benefits in exchange for not disclosing a vulnerability.
  • Comply with all applicable laws.

4. Safe harbor

If you make a good faith effort to follow this policy, [TODO: legal entity name]:

  • considers your research authorized, and will not pursue or support legal action against you for it, including under the Computer Fraud and Abuse Act, similar state laws, or the anti-circumvention provisions of the Digital Millennium Copyright Act;
  • waives any restriction in our Terms of Use or Acceptable Use Policy that would otherwise prohibit that research; and
  • if a third party takes legal action against you for research that complied with this policy, will make it known that your research was authorized by us.

This safe harbor covers only our own systems and our own legal claims. We cannot authorize testing of systems owned by others, such as Cloudflare or our email provider. If you are unsure whether something is allowed, ask us at security@lobbylabs.net before you do it.