Report a vulnerability

Send an email to security@lucil.app, in German or English.

Please tell us which address or feature is affected, the steps to reproduce it, what an attacker could achieve and how we can reach you (email or phone).

We do not offer encrypted email yet. So please do not include other people’s data, a description is enough.

A pseudonym is fine. Without a way to reach you, however, we cannot ask questions and can only handle a report to a limited extent.

Read the privacy policy

1. 1Within 5 working days a person confirms receipt, not an automated reply.
2. 2Within 10 working days we tell you whether we confirm the vulnerability, ask follow-up questions or explain why it takes longer.
3. 3We fix confirmed vulnerabilities as fast as we can and keep you updated.
4. 4We agree on publication with you. Our goal: as soon as the vulnerability is fixed, at the latest 90 days after your report.
5. 5If a vulnerability was exploited, we inform affected customers and, where the law requires it, the competent authorities.
6. 6If you wish, we thank you publicly once it is resolved, by name or pseudonym. We do not pay rewards at the moment.

• Only test with an account that belongs to you or on publicly reachable pages. Go only as far as needed to prove the issue.
• No attacks that disrupt the service (for example by overloading it), no spam and no deceiving of staff or customers.
• Do not access other people’s data and do not change or delete anything. Keep whatever you saw by accident to yourself and delete it after your report.
• Do not publish anything before the vulnerability is fixed and we have agreed on it.
• Do not pass on tools for exploiting the vulnerability to others.

lucil.app with the web app, the Lucil assistant in the chat and on WhatsApp, the server interfaces behind them, and the Lucil app for iPhone and Android once it is released.

Not in scope: vulnerabilities in services of other providers that Lucil uses (please report them there), results of automated scans without a demonstrable impact, and missing best practices without a concrete risk.

Draft, not yet reviewed by a lawyer.

If you act in good faith and follow these ground rules, we will not take legal action against you and will not file a criminal complaint. This does not apply where criminal intent is apparent.

We treat your report confidentially and only share your personal data with your explicit consent, unless the law requires us to.

We do not ask you to sign a non-disclosure agreement.

This commitment applies to us. We cannot speak for others, such as our customers, other providers or authorities.