What this policy covers
You may report a suspected issue affecting the LuxlyNight public website at the canonical hostname shown in the site metadata. Reports concerning any other domain, IP address, application, account, client system, employee, contractor, hosting control plane, CDN or security-provider infrastructure, email infrastructure, or other third-party service are outside this policy.
No testing authorization
Nothing on this page authorizes vulnerability scanning, exploitation, account creation for testing, control bypass, data access, traffic generation, or any other active security testing. If you noticed an issue through ordinary use, accidental discovery, or passive observation, report it without taking additional steps to confirm impact.
Never perform
- Denial-of-service, stress testing, or automated security scanning.
- Access to accounts, data, or functionality you are not expressly authorized to use.
- Destructive activity or modification or deletion of data.
- Social engineering, phishing, impersonation, or physical intrusion.
- Password spraying, credential stuffing, or use of credentials from another source.
- Malware, persistence, command-and-control, or lateral movement.
- Testing of employees, contractors, clients, vendors, provider systems, or client systems.
- Extortion, threats, or withholding details as leverage.
Report in two stages
First send a concise, non-sensitive summary to contact@luxlynight.com with the subject Security report. Include the affected public URL, the behavior you observed during ordinary use, the potential impact at a high level, when you observed it, and your preferred contact information.
Do not send live credentials, secrets, exploit code, full request or response bodies, third-party data, regulated data, unnecessary personal information, or detailed evidence through ordinary email. If more information is needed, LuxlyNight will arrange an appropriate channel after triage.
Coordination
We will make a reasonable effort to acknowledge complete reports, confirm whether they are in scope, investigate, and coordinate remediation and disclosure in good faith. Timing depends on severity, complexity, third-party dependencies, and reproducibility.