Lightspeed Retail

Description

Introduction Welcome to Lightspeed Retail. Help us fortify and secure our core global commerce infrastructure, spanning our omni-channel Ecommerce orchestration layers ( E-Series ) and our cloud-based point-of-sale systems ( X-Series ). The Lightspeed Bug Bounty Program is a cornerstone of our commitment to platform resilience, and we actively value collaboration with the global security research community to harden our ecosystem. This page is designed exclusively for security researchers. For general information regarding our corporate security practices, please visit our Main Security Portal . Public Disclosure Policy This program operates under a strict Coordinated Disclosure model. Because this is an invite-only environment, you must not discuss, publish, or leak any vulnerabilities or program details (including fully remediated or closed findings) outside of this platform under any circumstances. Failure to comply with these boundaries constitutes a severe policy violation and will result in immediate removal from the program, Bugcrowd platform escalation, and potential legal consequences. This program adheres fundamentally to Bugcrowd’s Standard Disclosure Terms . Ratings and Rewards Policy For the initial prioritization and rating of findings, this program utilizes the Bugcrowd Vulnerability Rating Taxonomy (VRT) . 💡 Triage Transparency: In certain cases, a vulnerability's priority level may be modified due to its real-world likelihood or unique architectural business impact. In any instance where an issue is downgraded, a full, detailed technical explanation will be provided to the researcher—along with an open opportunity to appeal the ticket and present a technical case for a higher priority level. Testing Rules of Engagement To protect the integrity of our staging infrastructure and avoid accidental IP blocks by our automated defense systems, all testing traffic must be clearly identifiable .

1. Unauthenticated Testing Guardrails Unauthenticated testing must focus on publicly exposed storefront endpoints, login gateways, and public checkout APIs to identify logical flaws, injection vectors, or authentication bypasses. Traffic Attribution (Mandatory): Because these tests are performed without an active user session, researchers must append a custom header to all HTTP traffic containing their unique Bugcrowd identifier (e.g., X-Bugcrowd-Ninja: [Your_Username] ). Infrastructure Exclusions: Generic infrastructure probing, port scanning, banner grabbing, and volume-based network directory brute-forcing are strictly out of scope and will trigger automated blocking.
2. Authenticated Testing Guidance Authenticated testing must focus on deep business logic flaws, multi-tenant boundaries, data isolation, and authorization states within the retail management layers. Credentials & Environments: These tests must be performed exclusively using the environments you have personally created or via pre-provisioned sandboxes provided to you at the bottom of this brief. Accessing, interacting with, or modifying data on any live, operational production customer retail stores is strictly prohibited.

Targets

Introduction Welcome to Lightspeed Retail. Help us fortify and secure our core global commerce infrastructure, spanning our omni-channel Ecommerce orchestration layers ( E-Series ) and our cloud-based point-of-sale systems ( X-Series ). The Lightspeed Bug Bounty Program is a cornerstone of our commitment to platform resilience, and we actively value collaboration with the global security research community to harden our ecosystem. This page is designed exclusively for security researchers. For general information regarding our corporate security practices, please visit our Main Security Portal . Public Disclosure Policy This program operates under a strict Coordinated Disclosure model. Because this is an invite-only environment, you must not discuss, publish, or leak any vulnerabilities or program details (including fully remediated or closed findings) outside of this platform under any circumstances. Failure to comply with these boundaries constitutes a severe policy violation and will result in immediate removal from the program, Bugcrowd platform escalation, and potential legal consequences. This program adheres fundamentally to Bugcrowd’s Standard Disclosure Terms . Ratings and Rewards Policy For the initial prioritization and rating of findings, this program utilizes the Bugcrowd Vulnerability Rating Taxonomy (VRT) . 💡 Triage Transparency: In certain cases, a vulnerability's priority level may be modified due to its real-world likelihood or unique architectural business impact. In any instance where an issue is downgraded, a full, detailed technical explanation will be provided to the researcher—along with an open opportunity to appeal the ticket and present a technical case for a higher priority level. Testing Rules of Engagement To protect the integrity of our staging infrastructure and avoid accidental IP blocks by our automated defense systems, all testing traffic must be clearly identifiable .

1. Unauthenticated Testing Guardrails Unauthenticated testing must focus on publicly exposed storefront endpoints, login gateways, and public checkout APIs to identify logical flaws, injection vectors, or authentication bypasses. Traffic Attribution (Mandatory): Because these tests are performed without an active user session, researchers must append a custom header to all HTTP traffic containing their unique Bugcrowd identifier (e.g., X-Bugcrowd-Ninja: [Your_Username] ). Infrastructure Exclusions: Generic infrastructure probing, port scanning, banner grabbing, and volume-based network directory brute-forcing are strictly out of scope and will trigger automated blocking.
2. Authenticated Testing Guidance Authenticated testing must focus on deep business logic flaws, multi-tenant boundaries, data isolation, and authorization states within the retail management layers. Credentials & Environments: These tests must be performed exclusively using the environments you have personally created or via pre-provisioned sandboxes provided to you at the bottom of this brief. Accessing, interacting with, or modifying data on any live, operational production customer retail stores is strictly prohibited. Program Rules Eligibility Internal Personnel: Current employees, contractors, or individuals with a direct professional relationship with our organization are ineligible to participate. Former Employees: Submissions from former Lightspeed employees are strictly ineligible for validation or rewards within one year (365 days) of their official departure date. Legal Compliance: Researchers must comply with all applicable local, national, and international laws. Non-compliance results in immediate program disqualification. Profile Requirements: Only public, viewable, and verifiable Bugcrowd profiles are eligible for participation and rewards. Platform Channel: All communication and compensation must go directly through Bugcrowd; internal employees cannot bypass this process. Scope & Target Guidance Strict Target Boundaries: Only security vulnerabilities found within explicitly listed domains and applications are in scope. Testing assets or subdomains outside the defined target list without written authorization is strictly prohibited. Data Privacy: Personal Identifiable Information (PII) or system metadata extraction must be limited to the absolute minimum required to prove impact. If sensitive data is accidentally exposed, stop testing immediately, do not download/cache the information, and submit your report right away. Credential Leaks & OSINT: We welcome valid open-source intelligence (OSINT) regarding exposed Lightspeed employee credentials containing the @lightspeedhq.com domain. Valid submissions will be evaluated case-by-case based on real business risk. Exclusion: Credentials surfaced via criminal activity (e.g., dark web forum dumps, malware stealer logs) are strictly out of scope and ineligible for rewards. Proof of Concept (PoC) Limits: Limit data collection and exploitation steps to the absolute minimum required to effectively demonstrate a working proof of concept. Strictly Enforced Testing Restrictions Environment Separation: Testing must only be conducted against store environments you have personally created for research purposes. Accessing, interacting with, or modifying data on any live, operational customer retail stores will result in immediate program disqualification. Account Abuse Boundaries: Do not abuse endpoints with excessive or aggressive injection requests. Do not attempt unauthorized password modifications or password-recovery brute-forcing on accounts you do not control. Prohibited Actions Any testing that impacts the reliability, availability, or operational uptime of our systems. Physical security testing of corporate facilities, employees, warehouses, or equipment. Social engineering techniques, including phishing, vishing, or spamming. Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks. Automated Volume Scanning: Extensive or aggressive scans using automated tools are strictly prohibited. Testing must be manual and targeted. High-volume scanning will trigger automatic IP blocks. Corporate Integration Isolation: Do not test third-party services and integrations utilized by clients (e.g., x-series-support.lightspeedhq.com ) without a valid PoC proving direct, cascading impact on core Lightspeed users. Corporate Buffer Policies Acquisition Safe Harbor Buffer: Security bugs identified in software or platforms belonging to newly acquired companies are explicitly ineligible for triage and rewards for a period of 90 days following the public acquisition announcement. N-Day Vulnerability Buffer: Publicly released zero-day vulnerabilities in underlying internet infrastructure or software libraries are ineligible for rewards for a period of 3 days (72 hours) following their initial public disclosure. Platform Specific Testing Guidance
3. Lightspeed eCom (E-Series) Account Setup: Register your test environment via https://my.ecwid.com/cp/#register . You must utilize your official Bugcrowd email platform alias ( [Username]@bugcrowdninja.com ). Subdomain Naming Convention: When configuring your Instant Site domain ( [yourstore].company.site ), you must append the string bugbounty to the subdomain layout (e.g., [yourstorebugbounty].company.site ) to facilitate automated backend identification. Extended Testing Needs: If your research requires advanced feature sets or plan-level changes to validate a flaw, submit a request via your report detailing your store account layout, and our team can adjust the subscription tier without charge. API Sandbox: To pull custom Postman collections and test raw API query behaviors, leverage the official development playground: https://api-playground.ecwid.com/#!/ . Review the E-Series API Documentation for structural formatting.
4. Lightspeed Retail (X-Series) Account Setup: Create your trial environments exclusively using your Bugcrowd email platform alias ( [Username]@bugcrowdninja.com ). Avoid creating excessive or rapid trial accounts against the public signup workflow. Authorized Authorization Testing Enclaves: Access control and privilege escalation testing within an X-Series environment must be focused around the following defined system profiles and permission zones: Account Types │ Description Admin │ The primary account owner with full platform access (Must be tied to your Bugcrowd alias). Non-Admin │ Limited profile accounts (Managers, Cashiers) with custom restricted permission maps. Account-Based Permission Map │ Target Sub-Areas For Privilege Testing Main Area: Sell │ Sales History Main Area: Catalog │ Promotions, Gift Cards Main Area: Setup │ Users, Apps, Personal Tokens, Store Credits ⚠️ Authorization & IDOR Severity Matrix To ensure consistency, X-Series privilege escalation findings are strictly triaged against the following business-impact thresholds: Cross-Tenant IDOR (Store A to Store B): Standard triage rules apply (Eligible for full Critical/High reward structures). Intra-Store Unauthorized Write Access: If a Non-Admin user account can successfully execute unauthorized Write operations (Create/Update/Delete) within their own store structure, it is capped at a flat P4 / Low minimum bounty payout. Intra-Store Unauthorized Read Access: If a Non-Admin user account can merely read or view unauthorized data models within their own store structure, it is completely Out of Scope and ineligible for rewards. Areas of Particular Interest We prioritize findings that expose severe backend flaws, data exposure risks, or cross-tenant contamination. Global Focus Areas Server-Side Request Forgery (SSRF) SQL Injection (SQLi) and functional Command Injection Cross-Tenant Insecure Direct Object References (IDOR) impacting separate retail organizations Open Redirect flaws that demonstrate a definitive, secondary high-severity impact (e.g., OAuth token theft to an external domain) Unauthorized PII or sensitive system data disclosure E-Series (Ecwid) Targeted Priorities Remote Code Execution (RCE) or arbitrary server-side code execution Authentication bypass workflows targeting access to my.ecwid.com/cp Complete circumvention of app extension or admin permission models High-impact Cross-Site Request Forgery (CSRF) targeting critical administrative state modifications Known Issues & Conditional Triage Matrix To prevent systemic blind spots in an era of automated scaling and AI fuzzer deployments, we no longer maintain absolute blanket bans on certain vulnerability classes. Instead, we utilize a "Prove the Business Risk" operational model. The following items are considered Known Issues in baseline environments and will be closed as Informational if reported as a theoretical or low-impact finding. However, if a researcher can demonstrate a unique, functional exploit chain that directly bypasses core application security boundaries, they are conditionally eligible for active triage: Rate Limiting & Brute Force: Submissions will only be triaged if missing on critical business-logic pathways resulting in verified fraud or account compromise (e.g., automated brute-forcing or generation of retail Gift Cards and promotional voucher codes, bypassing Multi-Factor Authentication checks on administrative profile updates, or brute-forcing Personal Tokens). Generic site-wide page-load rate limiting remains out of scope. CSV / Formula Injection: Triaged exclusively if a user can inject malicious payloads into shared retail data tables (such as Sales History lines, Promotions descriptions, or inventory matrices) that successfully trigger arbitrary command execution upon a merchant administrator's local machine during a CSV/Excel export action. Session Persistence & Invalidation: Triaged exclusively if active, authenticated sessions or application API tokens stubbornly persist and fail to terminate across concurrent endpoints following an explicit profile password modification, account recovery lifecycle event, profile email change, or session-revocation action. CDN File Hosting Abuse (E-Series): Triaged exclusively if a researcher can bypass standard input filters to drop and persistently serve active malicious script files, custom HTML, or cross-site tracking packages directly via our asset delivery networks to execute verified phishing campaigns under an official Lightspeed trusted domain. Out of Scope Vulnerabilities The following specific vulnerability types, behaviors, and configuration anomalies are explicitly excluded from financial rewards and triage consideration:
5. Designed Product Features & Client Controls Designed Merchant Customization (E-Series): E-Series platforms natively allow store owners to embed custom HTML and JavaScript into their storefronts and checkouts. Consequently, any issue where a store administrator inserts scripts into their own storefront, or scenarios where storefront areas execute within an admin-panel , are considered designed platform behavior and are out of scope. Stored XSS executing inside any analytical report templates under the "Reporting" subsystem. Cross-Site Scripting (XSS) anomalies specific to Angular frameworks, or XSS execution constrained within a sandbox element. Local mobile findings reliant on a rooted/jailbroken device, physical access to the target hardware, or data extraction from unsecured physical local backups. Submissions targeting the Token Request API endpoint or Mobile SSL Pinning mechanics within the Lightspeed Retail POS (X) iOS app. Exposed keys that are explicitly intended to be publicly available (e.g., public client-side deployment keys).
6. General Web & Formatting Noise Self-XSS (Reports require proof of cross-user compromise without self-sabotage). XSS requiring full control over localized HTTP transport headers (e.g., Referer, Host, User-Agent fields). Inconsistent character validation or length mismatches between UI input fields and backend APIs lacking verified security impact. Low-impact Cross-Site Request Forgery (e.g., Login/Logout/Signup CSRF, or CSRF targeting modification of unauthenticated shopping carts). Open Redirects lacking a functional, secondary credential/token exfiltration vector. Text Injection, HTML Injection, IFrame Injection, Hyperlink Injection, Content Spoofing, or Tabnabbing. Internationalized Domain Name (IDN) homograph attacks or Broken Link Hijacking. Password not required on non-sensitive actions, or general gaps in password complexity metrics.
7. Environment & Infrastructure Policy Exclusions Raw scanner outputs or unconfirmed automated vulnerability reports. Missing HTTP security headers, missing cookie flags on non-sensitive session models, or globally enabled HTTP methods (e.g., OPTIONS). Infrastructure verbose pages, stack traces, descriptive error logs, or software version banner disclosures. Domain mail configuration best practices (missing or incomplete SPF, DKIM, DMARC records) and general mail system abuse. Standard public documentation mapping files (e.g., robots.txt ). Distributed Denial of Service (DDoS), network DoS, or self-DoS vulnerabilities. Vulnerabilities affecting users on outdated, deprecated, or unsupported browsers (more than 2 stable versions behind the current release). Report Submission Format When reporting vulnerabilities, please use the format below with detailed information and reproducible steps in the Vulnerability Details field: Description Vulnerable URL/Location Steps to Reproduce Likelihood Analysis Impact Analysis Recommendation Other References (Optional) Safe Harbor When conducting vulnerability research in accordance with this policy, we consider this research to be: Authorized under the Computer Fraud and Abuse Act (CFAA) (and local equivalents); we will not pursue legal action for accidental, good-faith policy deviations. Exempt from DMCA circumvention restrictions on security controls. Lawful , constructive, and conducted in good faith. For scope clarifications prior to testing, please contact [email protected].

Lightspeed Ecommerce E-Series In Scope Targets (in scope)

This is the Control Panel - https://my.ecwid.com This is the Storefront Panel - [yourstore].company.site API - https://app.ecwid.com/api/v3/ Please note that "yourstore" is a placeholder only in the target scope. When you register an account, you will have your own Instant site domain in your store that you can edit in the form of [yourstore].company.site.

Out of Scope Targets (out of scope)

Please be sure to check the out of scope list below on the brief for further items you should not report. The section begins with the following: Privilege escalation and Insecure Direct Object References (IDOR) issues that have read/view access to endpoints in the scope of the same retailer store