Responsible Disclosure

We welcome reports for issues affecting our public website, APIs, and admin portal. Out-of-scope includes social engineering, physical attacks, and denial-of-service.

If you make a good-faith effort to comply with this policy while researching and reporting, we will not initiate legal action against you.

1. Describe the issue, impact, and affected endpoint or page.
2. Provide clear reproduction steps or a proof-of-concept.
3. Share minimal data necessary; avoid accessing other users' data.
4. Email: security@luxride.example