Responsible Disclosure

Report a vulnerability to LocalDesk privately. Please don't disclose it publicly, open a public issue, or post about it until we've had a chance to address it.

This policy is for security vulnerabilities. Questions about an account or an order go to LocalDesk support, as the Terms of Service describe.

In scope. LocalDesk's website and its APIs at localdesk.dev, the LocalDesk desktop app, and the LocalDesk services the app and the website use.

Out of scope. The services of the third parties we rely on (report those to their owners), social engineering or phishing of LocalDesk's people or users, physical attacks, denial-of-service or load testing, spam, and reports from automated scanners without a demonstrated impact.

• The affected component: the website, an API, the desktop app and its version, or a LocalDesk service.
• A clear description of the issue.
• Steps to reproduce it.
• Its potential impact: who or what could be affected, and how.
• Technical evidence, such as requests, responses, logs, or screenshots, with other people's data removed.
• How we can reach you for follow-up questions.

• Test only with accounts you own or have permission to use.
• Don't access, change, or delete other people's data. If you come across it, stop, don't keep or share it, and tell us in your report.
• Don't degrade the service: no denial-of-service, flooding, or testing that sends heavy traffic.
• Don't run destructive tests, and go no further than you need to show the issue.
• Don't manipulate payments or access beyond what's needed to show an issue, and don't send transfers to LocalDesk's payment address as part of a test.
• Don't use social engineering, and respect people's privacy throughout.
• Give us reasonable time to fix the issue before any public disclosure, and coordinate its timing with us.

A person at LocalDesk reviews every report. We'll follow up with you if we need more detail, keep you informed as we address confirmed issues, and coordinate the timing of any public disclosure with you.

LocalDesk doesn't currently offer a paid bug bounty.