
lemlist
External Program
Submit bugs directly to this organization
lempire is committed to working with security experts across the globe to stay up to date with the latest security techniques. If you have discovered a security issue that you believe we should know about, we'd welcome working with you. Please let us know about it and we'll make every effort to quickly correct the issue.
Please use your own accounts to conduct your research. Do not try to gain access to others' accounts or any confidential information. When creating accounts, use your hacker email alias, for ex: [email protected]
While researching, we'd like to ask you to refrain from:
DUPLICATE REPORTS Different exploitation vectors for the same bug or similar bugs may be considered duplicating if the security team believes information provided for a single vector/bug is enough to fix all vectors or bugs reported. A report for a known or duplicating vulnerability is considered as Duplicate. The report can be either a duplicate of another report from any bug bounty platform or a duplicate of the problem internally tracked by the Lempire security team. Usually, access to the original report or some information from the internal task tracker is provided to the reporter of a Duplicate. In some cases, information may not be provided if a Duplicate contains less information or a less critical exploitation vector than the original report. The report is considered duplicated to another report from any bug bounty platform if there is an original report in "New" or "Triaged" state with an earlier report date/time or lower report number, or if it updates the report in "N/A" or "Need more info" state and the original report is in "N/A" or "Need more info" state for less than 1 week, or sufficient information is provided in the original report by the researcher since the report is transferred to "N/A" or "Need more info" state. The report is considered a duplicate of an internal task if there is a task in the internal task tracker which is tracked by the Lempire security team at the time of the duplicate report. Also, public 0-day/1-day vulnerabilities may be considered as a duplicate within a few days after the vulnerability details publication, if the vulnerability is known to our team from public sources and we are working to mitigate or patch it.
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep lempire and our users safe!