LIFX
Vulnerability disclosure program on security.txt lifx.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 8
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
LIFX does not currently operate a monetary bug bounty program.
- Safe harbor
-
Full
LIFX, on behalf of Feit Electric Company, Inc., will not initiate civil or criminal legal action against researchers who discover and report security vulnerabilities in good faith in accordance with this policy.
- Hall of fame
-
Yes
We will publicly acknowledge researchers (with their consent) who report valid, in-scope vulnerabilities through this policy.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
8 assets you may test, 7 excluded.
Domains 3
- api.developer.lifx.com
- lan.developer.lifx.com
- lifx.com
APIs 2
- Cloud API — LIFX HTTP Cloud API (api.developer.lifx.com) and associated backend infrastructure
- LAN Protocol — LIFX LAN Protocol (lan.developer.lifx.com)
Wildcard domains 1
- web properties — lifx.com and any subdomains operated by lifx
Products and areas 2
- Device Firmware — Current production firmware for all LIFX smart lighting hardware, including bulbs, strips, tiles, and accessories
- Mobile Applications — LIFX iOS and Android apps (current and future App Store / Google Play releases and updates)
Out of scope (7)
- Automated scanning that generates excessive load on production systems
- Denial-of-service attacks or volumetric testing against any LIFX or Feit Electric infrastructure
- Discontinued or end-of-life LIFX hardware for which firmware updates are no longer being issued
- Physical attacks requiring destruction of a device or hardware manipulation not achievable by an ordinary end user
- Social engineering attacks targeting LIFX or Feit Electric employees, contractors, or support staff
- Third-party integrations and platforms, including Amazon Alexa, Google Home, Apple HomeKit, and Matter ecosystem partners
- Vulnerabilities in third-party libraries or components where the issue is not exploitable in a LIFX-specific context
Rules
What the policy asks of you, and the bug types it won't reward, quoted from LIFX's policy. "We" in these lines means the program, not this site.
While testing
-
Report privately first. Please disclose vulnerabilities to the LIFX security team before making any public disclosure.
-
Avoid accessing customer data. Do not access, modify, delete, or exfiltrate data belonging to our customers.
-
Do not disrupt services. Do not conduct testing that degrades the availability or performance of LIFX products or services for other users.
-
Limit testing to your own devices. Only test against hardware and accounts that you own or for which you have explicit authorization from the account holder.
-
Avoid disclosing vulnerability details to any third party before we have had a reasonable opportunity to address the issue
-
Not cause harm to customers, systems, or services operated by LIFX or Feit Electric
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.