Lightspeed Retail

Bugcrowd published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 9 Nov 2026.

Introduction Welcome to Lightspeed Retail. Help us fortify and secure our core global commerce infrastructure, spanning our omni-channel Ecommerce orchestration layers (E-Series) and our cloud-based point-of-sale systems (X-Series). The Lightspeed Bug Bounty Program is a cornerstone of our commitment to platform resilience, and we actively value collaboration with the global security research community to harden our ecosystem. This page is designed exclusively for security researchers. For general information regarding our corporate security practices, please visit our Main Security Portal. Public Disclosure Policy This program operates under a strict Coordinated Disclosure model. Because this is an invite-only environment, you must not discuss, publish, or leak any vulnerabilities or program details (including fully remediated or closed findings) outside of this platform under any circumstances. Failure to comply with these boundaries constitutes a severe policy violation and will result in immediate removal from the program, Bugcrowd platform escalation, and potential legal consequences. This program adheres fundamentally to Bugcrowd’s Standard Disclosure Terms. Ratings and Rewards Policy For the initial prioritization and rating of findings, this program utilizes the Bugcrowd Vulnerability Rating Taxonomy (VRT). 💡 Triage Transparency: In certain cases, a vulnerability's priority level may be modified due to its real-world likelihood or unique architectural business impact. In any instance where an issue is downgraded, a full, detailed technical explanation will be provided to the researcher—along with an open opportunity to appeal the ticket and present a technical case for a higher priority level. Testing Rules of Engagement To protect the integrity of our staging infrastructure and avoid accidental IP blocks by our automated defense systems, all testing traffic must be clearly identifiable. 1. Unauthenticated Testing Guardrails Unauthenticated testing must focus on publicly exposed storefront endpoints, login gateways, and public checkout APIs to identify logical flaws, injection vectors, or authentication bypasses. Traffic Attribution (Mandatory): Because these tests are performed without an active user session, researchers must append a custom header to all HTTP traffic containing their unique Bugcrowd identifier (e.g., X-Bugcrowd-Ninja: [Your_Username]). Infrastructure Exclusions: Generic infrastructure probing, port scanning, banner grabbing, and volume-based network directory brute-forcing are strictly out of scope and will trigger automated blocking. 2. Authenticated Testing Guidance Authenticated testing must focus on deep business logic flaws, multi-tenant boundaries, data isolation, and authorization states within the retail management layers. Credentials & Environments: These tests must be performed exclusively using the environments you have personally created or via pre-provisioned sandboxes provided to you at the bottom of this brief. Accessing, interacting with, or modifying data on any live, operational production customer retail stores is strictly prohibited.