Reporting a vulnerability
If you believe you have found a security vulnerability in a Lyria system, please report it to [email protected]. Include a description of the issue, the steps to reproduce it, the affected URL or system, and any proof-of-concept. Please encrypt sensitive details if possible; we can provide a key on request.
Scope
In scope: lyria.one and its subdomains, Lyria APIs and client-facing applications operated by Crestline Technologies Ltd.
Out of scope: third-party services we use, social engineering of our staff or partners, physical attacks, denial-of-service testing, and reports from automated scanners without a demonstrated impact.
Rules of engagement
- Do not access, modify or delete data that does not belong to you. Stop and report as soon as you encounter personal or financial data.
- Do not degrade the performance or availability of our services.
- Do not make payments or move funds other than with test credentials we provide.
- Give us reasonable time to fix the issue before disclosing it publicly, and coordinate disclosure with us.
- Comply with all applicable laws.
Our commitments
- We will acknowledge your report within 3 business days.
- We will keep you informed as we investigate and fix the issue.
- We will credit you publicly once it is resolved, if you wish.
- If you act in good faith and follow this policy, we will not take legal action against you in relation to your research.
Rewards
We do not currently run a paid bug bounty program, but we may choose to recognise particularly valuable reports.