The security of Loddi systems and data residing within them is crucial for us, and we treat potential security issues with a top priority. We do our best to protect the data of Loddi merchants and customers from security threats, and we encourage all users and security researchers to report security vulnerabilities discovered in our platform. We are committed to handle vulnerability reports in a timely manner and the greatest attention, provided that the following Policy is respected.
Loddi’s vulnerability disclosure program covers the following products:
Loddi Webr Application - https://MyLoddi.com/
While Loddi develops a number of other products, we ask that all security researchers submit vulnerability reports only for the stated product list from point 1 above, subject to point 3 below.
If you believe that you identified a critical risk vulnerability or potential data leakage which is not in scope from point 1 above, but still may negatively impact data of Loddi or its users, please do not hesitate to get in contact with us.
Please share privately the details of your security vulnerability by emailing our Security Team at [email protected].
When reporting, make sure to include as much information as possible, including screenshots, detailed steps to reproduce the problem, the application versions that are affected and any other information that might help us to triage vulnerability more efficiently.
You privately share the details of the security vulnerability with our Security Team by reporting an issue, as described in point II (1) above.
We acknowledge your submission and verify the vulnerability. Our first answer generally comes under 2 business days.
If the vulnerability is considered valid and in scope we work on a correction in collaboration with you to the extent you are comfortable with.
Once a vulnerability is patched by our product team we notify you about the fix and recognize you in our Hall of Fame, if you agree.
We ask you to obey the following rules at all times:
do not view or store Loddi’s non-public data (except the data necessary to document and report the presence of a potential vulnerability);
do not attempt to access or modify data that belongs to other Loddi user;
do not attempt to execute denial of service attacks, or to compromise the reliability and availability of Loddi services;
do not use scanners, automated tools or any other tools which may generate excessive traffic and negatively impact system’s availability;
never attempt non-technical attacks such as social engineering, phishing, or physical attacks against anyone or any system;
do not publicly disclose vulnerabilities without our prior consent (disclose only according to the disclosure procedure in point IV above).
When contacting us, please try to create a proof-of-concept attack (with screenshot if necessary) or a script exploiting the issue. If the proposed attack scenario turns out unrealistic, your report will probably be rejected with acknowledgement.
Qualifying vulnerabilities:
injection vulnerabilities;
XSS vulnerabilities working in supported browsers;
broken authentication or session management, allowing unauthorized access to sensitive data or account takeovers;
vulnerabilities resulting in arbitrary code execution or reading sensitive files/data (RCE, LFI, RFI, SSRF, XXE);
broken access control (privilege escalation, IDOR, CSRF);
sensitive information disclosure (PII, booking data, secrets, sensitive API keys, configuration files);
business logic vulnerabilities which allow to bypass intended business flow and cause harm to Loddi or its users;
other vulnerabilities where you are able to clearly demonstrate a negative impact on Loddi’s data & system security.
NON Qualifying vulnerabilities:
suboptimal HTTP header configuration (unless you are able to prove a non-theoretical impact of such a configuration);
suboptimal SSL/TLS configuration (unless you are able to prove a non-theoretical impact of such a configuration);
XSS vulnerabilities working only in unsupported/deprecated browsers, or requiring an action which is unlikely to be taken by an aware user (e.g. pressing some key combination);
user/e-mail enumeration vulnerabilities;
file path disclosures or error handling issues, which do not carry significant risk;
clickjacking or phishing attacks using social engineering tricks to abuse users, with the system working as intended;
suboptimal password policies;
non-permanent Denial of Service (DoS) and distributed DoS (DDoS) that maintain resource exhaustion (cpu/network/memory) via a sustained stream of requests/packets;
mobile vulnerabilities related to insufficient reverse engineering protection or client-side vulnerabilities which require e.g. compromised device to be exploited
disclosure of information that does not carry significant risks (e.g. server type);
suboptimal configuration of e-mail security policies (e.g. DKIM, DMARC).
If you have any concerns about the scope that should be reported to us, please do not hesitate to contact us.
If you report a non-duplicate security issue that is confirmed to be impactful (see the section in point V (2) above), we will be happy to include your name in the Loddi Security Hall of Fame section, if you agree.
If we consider that the vulnerability you reported has a major impact on Loddi security, such as critically sensitive information disclosure, remote access to core system authority, etc., you can be rewarded with an additional surprise.
Last updated April 17, 2025