Security

1. Reporting a Vulnerability

If you believe you have found a security vulnerability in Lucky Audio, email [email protected]. Please report it privately rather than on social media, in a review or in a public issue tracker, so it can be fixed before anyone else learns about it.

A useful report includes:

• The page, feature or address affected
• The steps that show the problem, and what you expected to happen instead
• What someone could do with it: whose data or account it exposes, or what it lets them change
• How to reach you if we have questions

A short, clear report is better than a long one. Screenshots are welcome, but please leave out anyone else’s personal data. The same contact details are published in machine-readable form at /.well-known/security.txt.

2. Please Do Not Test

This page is not an invitation to test Lucky Audio. There is no security testing program, and nobody has been authorized to probe, scan or attack this site, its accounts, or its payment and licensing systems. If you come across a problem in the course of normal use, we want to hear about it, and we ask that you:

• Stop as soon as you have seen enough to describe the problem, and report it promptly
• Do not access, change, download or keep data that is not yours. If you see someone else’s information by accident, stop there, do not save it, and tell us what you saw
• Do not run automated scanners, attempt to overload the service, guess passwords, send spam, or try to deceive our staff or customers
• Do not use the problem to obtain products, licences, refunds or access you have not paid for, or to reach further into our systems
• Keep the details private until we have fixed it, or until 90 days after your report, whichever comes first, and tell us before you publish

3. What You Can Expect From Us

• We will acknowledge your report within 5 business days
• We will tell you whether we can reproduce the problem, and keep you updated until it is fixed
• If you would like to be credited once it is fixed, tell us how you would like to be named

If you report a problem in good faith and follow the guidance on this page, we will not pursue or support legal action against you over that report. This covers reporting something you came across. It is not permission to do anything section 2 asks you not to.

4. No Bug Bounty

Lucky Audio does not run a bug bounty program and does not pay for reports. Please do not send a report in the expectation of payment, or make sharing the details conditional on one: we do not negotiate over vulnerability information.

Now and then a report saves us from real harm. When that happens we may choose to thank the reporter, sometimes with a reward. That is decided case by case, entirely at our discretion, and is never owed.

5. What We Do Not Treat as a Vulnerability

The following are not vulnerabilities on their own. Report one only alongside a demonstrated way to harm a user or the service:

• Output from an automated scanner, or a missing “best practice” header, cookie flag or TLS setting, with no working attack
• Email authentication settings (SPF, DKIM, DMARC)
• Clickjacking on pages with no sensitive action
• Software version numbers, server banners, or error pages that reveal nothing sensitive
• Problems that need an already compromised device or account, physical access, or the victim pasting code into their own browser
• Denial of service, missing rate limits on pages with no sensitive action, and social engineering

Vulnerabilities in the services we rely on, such as our payment provider, hosting or email delivery, belong with that provider’s own disclosure program. If you think the way we use one of them is the problem, tell us.