If you find a security problem in this site, tell us. This page says how, what happens next, and what we promise the person who reports it.
How to report
Email hello@lfw.com.
Include the page or address involved, what you did, and what you saw. A screenshot or the exact request helps.
If the report contains something sensitive, say so in the first line. We will move to a private channel before any detail is exchanged.
The same contact is published for machines at /.well-known/security.txt.
What we do
- A person replies within two business days to confirm we have it.
- We tell you whether we can reproduce it and what we intend to do.
- Fixes for confirmed problems ship as normal operations work, usually within days. We tell you when the fix is live.
- If you want credit, we will name you here once the fix is live. If you would rather stay anonymous, we respect that.
We do not pay bounties. We do say thank you, and we mean it.
Passwords
There are none.
The client portal and our own admin desk sign in with a one-time link sent to the email address on the account. Nothing is created, stored, or reused.
That is why the standard change-password address on this domain brings you here instead of to a form.
If you lose access to the email address on your account, write to us. We will move the account to a new address after confirming it with you.
What is in scope
LFW.com and the services that run under it: the client portal, the audit tool, and the forms.
Client websites LFW manages are not covered by this page. Each client owns its own site and its own policy. If you find a problem on one, contact that organization, and you may copy us.
What we ask
- Do not read, change, or download data that is not yours. If you reach it by accident, stop, note what you saw, and tell us.
- Do not run denial-of-service tests, spam the forms, or try to brute-force the one-time sign-in links.
- Do not test through social engineering, phishing, or physical access.
- Give us a reasonable time to fix a problem before you publish it. Two weeks after our confirmation is usually plenty; ask if you need a date.
What we promise
If you follow the rules above and act in good faith, LFW will not take legal action against you for the research, and we will not report you to law enforcement for it.
If someone else raises a claim about your research on this site, we will say publicly that you had our permission.
This is our commitment for LFW.com. It cannot bind a third party.
Out of scope
- Findings that need an outdated browser or a device the visitor has already compromised.
- Reports from automated scanners with no working demonstration.
- Missing best-practice headers with no shown effect, rate-limit observations, and version disclosures on their own.
- Problems in third-party services we use rather than run, such as our DNS or email providers. Report those to the provider.