Bug bounty program

Find security issues in Lumin and get a reward with our vulnerability disclosure program.

Table of contents

  • Policy

  • Rewards

  • Rules for reporting

  • In scope

  • Out of scope

  • What we are looking for

  • What we are not looking for

  • Policy
  • Rewards
  • Rules for reporting
  • In scope
  • Out of scope
  • What we are looking for
  • What we are not looking for


The following guidelines give you an idea of what we usually pay out for different classes of security issues. Low-quality issues may be rewarded below these tiers, so please make sure that there is enough information for us to be able to reproduce your issue and step-by-step instructions including how to reproduce your issue. Screenshots are also helpful, but please make sure to not make these public before submitting them to follow our program’s rules.


Security vulnerabilityMobile crash/ANR
Most criticalCriticalHighMediumLow
600 USD - 1200 USD400 USD - 600 USD200 USD100 USD50 USD500 USD
Security vulnerability
Most criticalCritical
600 USD - 1200 USD400 USD - 600 USD
200 USD100 USD50 USD
Mobile crash/ANR
500 USD

Rules for reporting

  1. Report a qualifying vulnerability that is in the scope of our program (below).
  2. Be the first person to report the vulnerability.
  3. Be reasonable with automated scanning methods so as to not degrade services.
  4. Refrain from disclosing the vulnerability until we've addressed it.
  5. NEVER try to gain access to a real user's account or data.
  6. You must not leak, manipulate, or destroy any user data.
  7. Do not impact users with your testing.

In scope

  1. app.luminpdf.com
  2. luminpdf.com
  3. Android & iOS applications versions
  4. sign.luminpdf.com

Out of scope

  1. tools.luminpdf.com
  2. help.luminpdf.com

What we are looking for

  1. Cross-site scripting (XSS)
  2. Cross-site request forgery (CSRF)
  3. Insecure direct object reference (IDOR)
  4. Account takeovers
  5. SQL Injection
  6. Authentication flaws
  7. Remote code execution (RCE)
  8. Server-side request forgery (SSRF)
  9. XML External Entity Attacks (XXE)
  10. Anything not listed but important

What we are not looking for

  1. Vulnerabilities requiring physical access to the victim's unlocked device
  2. Denial of Service attacks
  3. Brute Force attacks
  4. Spam or Social Engineering techniques
  5. Content Spoofing
  6. Best practices concerns
  7. Issues relating to Password Policy
  8. Issues relating to token lifetime
  9. User enumeration
  10. Full-Path Disclosure on any property
  11. CSRF-able actions that do not require authentication (or a session) to exploit
  12. Reports related to missing security headers
  13. CSV Injection
  14. Reverse Tabnabbing
  15. Bugs that do not represent any security risk
  16. Vulnerabilities that are limited to unsupported browsers

How to report?

Please send all security reports to [email protected]

Learn more about Lumin security

Lumin has a robust, modern security system. We focus on customized security solutions in conjunction with industry-standard compliance.

Explore security center
Explore security