Responsible disclosure

If you find a security vulnerability in Logo.dev, tell us. We appreciate the work, and we fix confirmed issues quickly.

How to report

Email security@logo.dev with:

• The affected URL, endpoint or component.
• The steps to reproduce the issue.
• What an attacker could do with it.
• Any proof of concept, screenshots or logs.

What we commit to

• We confirm that we received your report.
• We keep you informed while we investigate and fix the issue.
• We take no legal action against research that follows the rules below.
• With your permission, we credit you when the fix ships.

We don't run a paid bug bounty program.

Rules

• Test only with accounts and API keys you own. Don't access, change or delete other people's data.
• Don't degrade the service: no denial-of-service tests, load tests or automated scans that send high volumes of traffic.
• No social engineering, phishing or physical attacks.
• Give us reasonable time to fix an issue before you disclose it publicly.

Out of scope

• Publishable API keys (pk_) visible in a website's source. They are designed to be public; see our API keys docs.
• Reports from automated scanners with no demonstrated impact.
• Missing best-practice headers or DNS records with no exploit.
• Vulnerabilities in third-party services we use; report those to the vendor.

For our security practices, see the security overview.