Responsible disclosure
Found something?
Please tell us.
We would rather hear from you than find out later. If you report a vulnerability in good faith under the terms below, we will not pursue you — and we will keep you in the loop until it is fixed.
How to reach us
Email security@lumavo.ai. Include enough detail to reproduce it — a short write-up is worth more to us than a proof of concept.
We aim to acknowledge within two business days. Our machine-readable contact lives at /.well-known/security.txt.
What we ask while you test
Use an account you created yourself. Please do not:
- access, modify, or keep data belonging to anyone other than you
- run scans heavy enough to degrade the service for a working photographer
- use social engineering, phishing, or physical access against our staff or customers
If you think showing real impact needs you to touch another account, stop and describe it to us instead. We will take your word for it. That line matters: crossing it turns a report we would thank you for into unauthorised access to a real business’s data.
What we will do
Acknowledge your report, tell you what we found, keep you updated while we fix it, and credit you publicly if you would like to be credited.
We are a small company and do not currently run a paid bounty program. We would rather say that plainly up front than imply one and disappoint you.
Why this page exists
In August 2026 someone spent two days probing Lumavo, found a privilege-escalation flaw, and used it. Judging by the account they signed up with, they may well have been a researcher. They had no way to tell us — there was no security contact anywhere on this site, so their only options were to say nothing or to do what they did.
We closed that flaw within 48 hours and wrote down how it happened. This page is the other half of the fix: the next person who finds something now has somewhere to send it.