Contact: mailto:security@lootcodes.com
Expires: 2026-10-24T12:00:00.000Z
Preferred-Languages: en
Canonical: https://www.lootcodes.com/.well-known/security.txt

# Security Policy

If you discover a security vulnerability in LootCodes, please report it to us privately.

## Reporting Guidelines

- Email security findings to security@lootcodes.com
- Include detailed steps to reproduce the issue
- Allow us reasonable time to address the issue before public disclosure
- We appreciate responsible disclosure practices

## Scope

In scope:
- Authentication and authorization bypasses
- SQL injection vulnerabilities
- Cross-site scripting (XSS)
- Payment processing vulnerabilities
- Product key leakage
- Sensitive data exposure

Out of scope:
- Social engineering attacks
- Physical security
- Third-party services (Stripe, Supabase)
- Rate limiting testing beyond reasonable limits

## Recognition

We appreciate security researchers who help keep LootCodes secure. Responsible reporters may be acknowledged in our security hall of fame (with permission).