Lecturio Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
source: https://www.lecturio.com/vulnerability-disclosure/
policy:
- https://www.lecturio.com/vulnerability-disclosure
contact:
- mailto:security@lecturio.com
preferred_languages:
- en
expires: '2027-07-09T00:00:00Z'
canonical: https://www.lecturio.com/.well-known/security.txt
program:
  type: self-managed
  platform: none
  note: >-
    Lecturio runs its vulnerability disclosure program directly rather than through HackerOne, Bugcrowd,
    or Intigriti. Reports are accepted only via security@lecturio.com.
  bounty: true
  bounty_max: 50 EUR per report
  bounty_payment: PayPal
  bounty_conditions:
  - first-to-report
  - working proof of concept required
  - demonstrated data-privacy risk or system-integrity impact
  - confidentiality required until a fix is deployed
safe_harbor: true
safe_harbor_note: >-
  Good-faith security testing conducted within the stated policy guidelines is treated as authorized and
  receives legal protection.
response_targets:
  acknowledgement: 3 business days
  notification: on remediation
scope:
  in_scope:
  - '*.lecturio.com main web application'
  - Official iOS application
  - Official Android application
  out_of_scope:
  - Third-party integrations (Zendesk, Slack, AWS)
  - Marketing landing pages on subdomains
excluded_findings:
- Missing SPF/DKIM/DMARC records
- Missing security headers with no demonstrated exploit
- Clickjacking with no sensitive action
- Theoretical or best-practice suggestions with no impact
- Software version disclosure
prohibited_activities:
- Contacting executives, board members, or customer success staff
- Denial of service testing
- Social engineering or phishing of employees
- Physical security testing
- Accessing or exfiltrating customer data
evidence:
- source: well-known/lecturio-security.txt
  kind: security.txt
  status: 200
- source: https://www.lecturio.com/vulnerability-disclosure/
  kind: disclosure-policy-page
  status: 200