- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 7
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
However, we may, at our sole discretion, offer: Monetary rewards
- Response
-
Within 3 days
Acknowledge receipt within 72 hours
- Safe harbor
-
Full
If you act in good faith, follow this policy, avoid privacy violations and service disruption, and give us a reasonable opportunity to investigate and remediate the issue, Lighter will not pursue legal action against you for your research.
- Hall of fame
-
Yes
If you would like public credit after remediation, please let us know in your report.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
7 assets you may test, 13 excluded.
Domains 3
- app.lighter.xyz
- elliot.ai
- lighter.xyz
APIs 2
- API endpoints documented in Lighter Docs and the API reference schema
- Public-facing APIs operated by Lighter
Products and areas 2
- Official Lighter-managed backend systems and infrastructure
- Official Lighter mobile applications
Out of scope (13)
- Denial-of-service, traffic flooding, or resource exhaustion testing
- Findings that require access to another user's seed phrase, private keys, device, email, or credentials
- Issues that require a rooted or jailbroken device without meaningful real-world impact
- Low-impact clickjacking
- Missing headers or best-practice recommendations without demonstrated exploitability
- Physical attacks
- Reports based only on missing rate limits without demonstrated abuse impact
- Reports based solely on third-party CVEs without a demonstrated exploit path in a Lighter-operated asset
- Self-XSS requiring unrealistic user interaction
- Social engineering, phishing, or impersonation attacks
- Spam or automated scanner output without a validated vulnerability
- Version disclosure or banner disclosure
- Vulnerabilities in third-party services, wallets, SDKs, exchanges, infra providers, or dependencies not operated by Lighter
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Lighter's policy. "We" in these lines means the program, not this site.
While testing
-
Act in good faith
-
Avoid harming users, markets, or platform integrity
-
Avoid accessing, altering, or exfiltrating data that does not belong to you
-
Avoid actions that could impact user funds, order flow, balances, or account state beyond the minimum necessary to demonstrate the issue
-
Avoid exploiting vulnerabilities for profit, trading advantage, liquidation advantage, or market manipulation
-
Avoid disclosing the issue publicly before we have had a reasonable opportunity to investigate and remediate it
-
Limit testing to accounts, wallets, devices, and assets you own or are explicitly authorized to use
-
If you are unsure whether a testing approach is acceptable, contact us first .
Not accepted
-
Missing headers or best-practice recommendations without demonstrated exploitability
-
Version disclosure or banner disclosure
-
Low-impact clickjacking
-
Reports based only on missing rate limits without demonstrated abuse impact
-
Self-XSS requiring unrealistic user interaction
-
Issues that require a rooted or jailbroken device without meaningful real-world impact
-
Reports based solely on third-party CVEs without a demonstrated exploit path in a Lighter-operated asset
-
Social engineering, phishing, or impersonation attacks
-
Physical attacks
-
Denial-of-service, traffic flooding, or resource exhaustion testing
-
Spam or automated scanner output without a validated vulnerability
-
Vulnerabilities in third-party services, wallets, SDKs, exchanges, infra providers, or dependencies not operated by Lighter
-
Findings that require access to another user's seed phrase, private keys, device, email, or credentials
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.