Security and trust
Last updated: June 17, 2026
The security of our users, creators and their data is a priority for us. This page describes how to report vulnerabilities and what security practices we apply at LookCam.
1. Reporting vulnerabilities (VDP)
If you've found a vulnerability or security issue, please report it responsibly to [email protected]. You can find a machine-readable version of this policy at /.well-known/security.txt.
2. Scope
This policy covers the LookCam service, its public API and client applications (web and mobile). Out of scope: social engineering of staff and users, physical attacks, volumetric DoS/DDoS attacks, spam and vulnerabilities in third-party services we don't control. Please test only on accounts you own and don't interfere with other users' data.
3. Safe harbor
Good-faith actions that comply with this policy and respect the privacy of others are treated as authorized. We will not pursue legal action against researchers who follow the rules and promptly report their findings, giving us a reasonable time to fix them before public disclosure.
4. Response time
We acknowledge receipt of a report within 3 business days, provide an initial assessment within 10 business days, and keep you informed of progress until the vulnerability is fixed. Please don't disclose details publicly until a fix has shipped.
5. Our security practices
Among others, we apply:
- encryption of data in transit (TLS) and at rest;
- two-factor authentication (2FA) for accounts;
- refresh-token rotation with token theft detection;
- regular, encrypted backups;
- the principle of least privilege and system access segmentation.
6. Bug bounty program
We run a self-managed vulnerability reward program. Rewards are discretionary and decided case-by-case based on severity, report quality and real-world impact. The ranges below are indicative:
| Severity | Reward | Examples |
|---|---|---|
| Critical | €500 – €2 000 | RCE, mass data leak, account takeover without interaction, SQL injection |
| High | €200 – €500 | authentication bypass, IDOR exposing other users' data, SSRF, privilege escalation |
| Medium | €50 – €200 | stored XSS, CSRF with significant impact, leaking sensitive configuration data |
| Low / informational | thanks + Hall of Fame | minor issues with no real impact, missing hardening measures |
What qualifies
Remote code execution (RCE), SQL injection, authentication/authorization bypass, IDOR, XSS, SSRF, privilege escalation and sensitive data leaks — with a working proof of concept (PoC).
What doesn't qualify
- missing security headers or rate limits alone, without demonstrated impact;
- self-XSS, clickjacking on pages with no sensitive actions;
- DoS/DDoS attacks, social engineering, physical attacks;
- reports from automated scanners without verification and a PoC;
- vulnerabilities in third-party services outside our control.
Rules
- we reward the first report of a given root cause (one reward per issue);
- test only on your own accounts and don't compromise other users' data;
- the reward decision is made after validation and a fix has shipped; the safe harbor from section 3 applies.
- please don't disclose details publicly until a fix has been released.
Send reports to [email protected] (optionally with a PGP key — available on request).
7. Trust and compliance
We operate in compliance with GDPR/ePrivacy and the EU Digital Services Act (DSA). Details:
- Subprocessor list and DPA — who we process data with and for what purpose;
- DSA compliance — contact point and illegal-content reporting;
- Transparency report — moderation and request statistics;
- Service status — current availability and incident history;
- Privacy Policy — the full description of our data processing.
8. Acknowledgements (Hall of Fame)
We thank the researchers who responsibly reported vulnerabilities and helped us protect our users. A list of names will appear here after the first confirmed reports — let us know in your report if you'd like to be credited.
9. Contact
Security matters: [email protected]. Other matters: [email protected]. Our data processing practices are described in the Privacy Policy.