Skip to content
Lumeya
DESign inRequest beta access

Legal and fair dealing

Report a security issue

Have you found a vulnerability in Lumeya? Thank you for reporting it to us instead of exploiting it. We take every report seriously.

How to Report a Vulnerability

  • Write to office@luminantmind.com, ideally with the subject "Security". German or English are both fine.
  • Describe what you found, where (address or function) and how we can reproduce it. A short step-by-step description helps us most.
  • Please do not send any passwords, credentials or other people's data, even if you saw them during your testing.

What We Do

  • We confirm receipt as soon as we have read your report and keep you updated on progress.
  • We review the report and fix confirmed vulnerabilities as quickly as possible. We will let you know once it is fixed.
  • If you wish, we will credit you as the finder after the fix. We do not currently offer a monetary reward.

Ground Rules for Your Testing

If you comply with these rules, we will regard your testing as carried out in good faith. We will then not take legal action against you and will not file a criminal complaint because of your testing:

  • Test only with your own account or with accounts you created yourself for testing.
  • Do not access, modify or delete other people's data. If you nevertheless come across someone else's data, stop immediately, do not store any of it and let us know.
  • No attacks that disrupt operations (for example overload, mass requests or spam through forms), no deception of customers or our team, no attacks on buildings or devices.
  • Do not test our customers' websites under their own domains or services of other providers. These do not belong to us.
  • Exploit a vulnerability only to the extent necessary to demonstrate it.
  • Publish details only once the vulnerability has been fixed, and agree the timing with us.

This commitment applies to Lumeya as the operator. We cannot exclude the rights of others, for example our customers, or statutory obligations with it.

What We Do Not Regard as a Vulnerability

  • Results of automated scanners without a demonstrable impact.
  • Missing settings or headers where no attack results from them.
  • Attacks that only work with full access to your own device or your own account.

Machine-Readable and Other Channels