Security is foundational to how Lastpack operates — we design, build, and run the platform to protect user accounts and transactions at every layer, from the code we ship to the way we process payments, Purchase Funds, Eligible Sale Proceeds, and data. This page covers, at a high level, the measures we take, and how to report a vulnerability if you find one.
How we protect your account and transactions
Our defenses target:
Role-based access control and least-privilege enforcement
Provider-backed authentication and session management
Web application firewall (WAF), rate limiting, and bot mitigation
TLS encryption in transit and a strict Content-Security-Policy
Encryption of sensitive data and environment-isolated secrets management
Secure payment and transaction processing using managed wallet and transaction-signing infrastructure
Provably-fair, tamper-evident transaction and audit integrity
Input validation and output encoding to mitigate injection and XSS
Dependency and supply-chain vulnerability screening
Continuous logging, monitoring, and anomaly detection
Per-transaction limits and review controls on Cash Out requests
Regular code review, security testing, and timely patching
We work with established security partners — including Cloudflare for network, edge, and DDoS protection, and Privy for authentication and wallet infrastructure — to strengthen these controls.
No system is perfectly secure. We layer defenses so a single failure isn't catastrophic, and we respond quickly when something is reported.
Responsible disclosure
If you discover a security vulnerability, please report it to us privately and give us a reasonable chance to fix it.
Email: [email protected]
Include enough for us to reproduce it: the steps you took, the impact you believe it has, and any proof-of-concept code or screenshots. The clearer the report, the faster we can act.
Rewards
We may, at our discretion, reward valid reports based on the severity and real-world impact of the issue. There's no fixed payout table — eligibility and amount are decided case by case. Acting in good faith and following the rules below is a condition of any reward.
Safe harbor
We consider good-faith security research that follows this policy to be authorized access to our systems. If you act in good faith and stay within these rules, we will not pursue or support legal action against you for your research — including claims under the Computer Fraud and Abuse Act (CFAA) or the anti-circumvention provisions of the DMCA — and we will not report you to law enforcement. If a third party brings an action against you for activity that complied with this policy, we will make clear that your research was authorized.
While researching, please do:
Test only against your own account and your own data.
Give us a reasonable time to investigate and remediate.
Act in good faith and avoid privacy violations or service disruption.
Please do not:
Access, modify, or destroy data that isn't yours.
Degrade or disrupt the service — no denial-of-service, volumetric, or load testing.
Social-engineer or physically target our staff, users, vendors, or facilities.
Pivot into third-party services or infrastructure we don't own.
Keep, share, or exfiltrate any data you come across — stop, and tell us instead.
Demand payment, set a deadline, or threaten disclosure as a condition of reporting or withholding a vulnerability.
Withholding a vulnerability or pressuring us — demanding payment, threatening to disclose or sell it, or setting an ultimatum — in exchange for not disclosing it is extortion, not security research. It forfeits this safe harbor and any reward, and we will respond accordingly, including by involving law enforcement.
Out of scope:
Automated scanner output without a working proof-of-concept.
Missing “best-practice” headers or configuration with no demonstrated impact.
Spam, rate-limiting, or brute-force reports.
Vulnerabilities in third-party platforms we don't control.
Thank you to the researchers who help keep Lastpack and its users safe.