Lepta QA
Sign in

Security disclosure

Report a
security issue.

We take security seriously and want to make it easy for researchers to reach us. Read the scope, then send us your finding through the secure feedback widget.
/.well-known/security.txt

Our commitments

What you'll get back from us.

Acknowledged in 2 business days

A human on our security rota picks up every report — no autoresponder walls.

Triaged in 5 business days

Severity, reproduction, and rough remediation timeline shared with the reporter.

Credit on request

Named acknowledgment on our security hall of fame page after the fix ships (or immediately, if you prefer to stay anonymous).

No legal action

Good-faith research that follows this policy will not be pursued under CFAA, CMA, DMCA, or their local equivalents.

In scope

What we want you to test.

  • lepta.dev and any subdomain we operate (marketing, app, api, status, docs).
  • The Lepta QA REST API and outgoing webhooks.
  • Any Lepta-authored open-source runner or SDK we publish.
  • Client-side JavaScript we ship on our own domains.
Out of scope

Please don't do this.

  • Denial-of-service or resource-exhaustion attacks.
  • Physical attacks against our office, staff, or property.
  • Social engineering of Lepta employees or contractors.
  • Testing that impacts other customers' workspaces — use your own workspace or a scratch account.
  • Automated scanner reports without a working proof-of-concept.
  • Missing security headers on pages that don't handle sensitive data.
  • Rate-limit-only findings that require abusing a valid account.
  • Reports about email spoofing on domains we don't send from.
  • Third-party integrations (GitHub, Zoom, Slack, etc.) — please report those to the vendor.

Rewards

Bounty bands, paid in credits.

Indicative ranges paid in Lepta QA platform credits. Final amounts reflect severity, quality of the report, and business impact. Credits apply to any paid plan, credit-pack top-up, or overage on your own workspace — or you can gift them.

SeverityRewardExample
Critical50,000 – 250,000 creditsRCE, tenant isolation break, workspace-wide data exposure.
High25,000 – 75,000 creditsAuthentication bypass, IDOR on a critical resource, stored XSS with session takeover.
Medium7,500 – 25,000 creditsReflected XSS with limited impact, CSRF on a state-changing route.
Low2,500 – 7,500 creditsMissing hardening, information leaks without direct exploit path.

Credits are non-transferable to cash and expire 12 months after issue. Rewards are discretionary and paid at Lepta's sole discretion.

Ready to report?

Send us your finding through the secure feedback widget. Include a proof-of-concept and impact assessment where possible — you can attach screenshots and recordings right in the form.

FAQ

Common questions.

How do I send you a report?+
Use the Security report button on this page — it opens the in-app feedback widget which routes straight to our security rota. Include: a description, steps to reproduce, expected vs. observed behaviour, and any impact assessment. You can attach screenshots, screen recordings, and log files right from the widget.
Do you pay bounties?+
Yes — rewards are paid in Lepta QA platform credits (see bands above). Credits apply to any paid plan, credit-pack top-up, or overage on your own workspace, and can also be gifted to a workspace of your choice. Amounts scale with severity and quality of the report. First-reporter wins; duplicates are eligible for a smaller finder's fee if the original was still under embargo.
Can I test in production?+
Yes, but only against your own workspace and only using accounts you control. Never test against a customer workspace you don't own. Use realistic-but-obviously-test data (Test User Alpha, not real PII) and rate-limit yourself.
How long do I need to keep the finding private?+
90 days from initial report, or until we ship a fix — whichever comes first. If we can't fix it in 90 days we'll ask for an extension and explain why. Coordinated disclosure builds trust both ways.
/.well-known/security.txt

Ready to ship
without the dread?

Free to start, no credit card. Spin up your first project and invite your team in minutes.

Start freeOr sign in →