Security and Responsible Disclosure

Last updated: 5 October 2026

Keeping your projects, accounts and data safe is a core part of how we build Lumy. This page describes our main security measures and how security researchers can report vulnerabilities to us responsibly.

1. How we protect Lumy

Encryption in transit. All traffic to Lumy is encrypted with HTTPS.
Encryption at rest. Stored data is encrypted at rest by our cloud hosting provider.
Connected keys. Keys you connect, such as your own Stripe, GitHub, Twilio, Mailchimp or Brevo keys and webhook secrets, are stored with an additional layer of encryption. Webhooks we send are signed (HMAC-SHA256) and go only to public https addresses, never to private networks.
Sign-in. Google is the only way to sign in, so we never hold your password. Sign-in keys are stored hashed.
Sandboxing. Games and apps run in a sandbox, separated from the studio and from your account.
Limited access. Staff access to user data is limited to what is needed for their role and is logged.
Abuse controls. Rate limits, per-network build limits, platform-wide safety caps and automated abuse detection protect the service.
Our providers. We use established providers for hosting, AI, sign-in, email and payments, under contracts that include security and confidentiality obligations.

We do not claim any security certification (such as SOC 2) today. Businesses with security questions can open a ticket at /support under "Business and teams".

2. Keeping your account safe

Keep the Google account you sign in with secure, for example with 2-step verification.
Never share your Google password or verification codes, and do not put secrets, passwords or keys into prompts or project code.
Lumy staff will never ask for your password, verification codes, card number or keys.
If you believe your account is compromised, report it straight away with a Security report.

3. Reporting a vulnerability

Report security issues with a Security report ticket. Please include:

a description of the issue and its possible impact;
the affected page, feature or address;
clear steps to reproduce it, with any proof of concept; and
how we can contact you.

Security reports are treated as urgent. We aim to acknowledge them within 24 hours on business days, to give you an initial assessment within 5 business days, and to keep you informed until the issue is resolved. These are targets, not guarantees.

4. Scope

In scope: luminary.gg and its subdomains, the Lumy studio, the Lumy sign-in, support, help agent and publishing systems, and the built-in game and app backend.

Out of scope:

projects built and published by users (report harmful projects at /abuse; report a bug in your own project through the studio);
third-party services, including sign-in providers, payment providers and services you connect;
findings from automated scanners without a demonstrated, exploitable impact;
missing security headers, cookie flags or best practices without a demonstrated impact;
clickjacking on pages with no sensitive actions, self-XSS, and issues that require a compromised device or browser;
rate limiting or brute force on non-sensitive endpoints;
denial-of-service, spam and social engineering;
vulnerabilities in outdated browsers.

5. Rules of engagement

When researching, you must:

only test against your own accounts and projects, or accounts you have explicit permission to use;
never access, change, download, delete or keep other people's data. If you encounter it by accident, stop, do not share it, and tell us in your report;
not degrade, disrupt or overload the service, and not run denial-of-service or high-volume automated tests;
not use social engineering, phishing, spam or physical attacks against users, staff or providers;
not use prompt injection to attack other users or to extract and publish our system instructions or kit; limited, non-destructive testing of our own safety measures, reported to us promptly, is allowed;
not exploit an issue beyond what is needed to prove it;
give us reasonable time to fix the issue before you share any details with anyone else, and not share them without our agreement; and
follow the law.

6. Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not pursue or support legal action against you for it, and we will work with you to understand and fix the issue. If a third party brings action against you for research that followed this policy, we will make it known that your work was authorised. This safe harbour does not cover activity that breaks these rules or the law, and it cannot bind third parties.

7. Rewards

We do not run a paid bug bounty program at this time, and we do not pay for reports. With your permission, we are happy to thank you publicly once an issue is fixed. Demands for payment in exchange for not disclosing an issue are not good-faith research.

8. Incidents affecting you

If a security incident affects your personal data, we will notify you and the authorities as the law requires. Makers whose apps process end-user data are covered by the notification terms in our Data Processing Addendum.

1. How we protect Lumy

Encryption in transit. All traffic to Lumy is encrypted with HTTPS.

Encryption at rest. Stored data is encrypted at rest by our cloud hosting provider.

Connected keys. Keys you connect, such as your own Stripe, GitHub, Twilio, Mailchimp or Brevo keys and webhook secrets, are stored with an additional layer of encryption. Webhooks we send are signed (HMAC-SHA256) and go only to public https addresses, never to private networks.

Sign-in. Google is the only way to sign in, so we never hold your password. Sign-in keys are stored hashed.

Sandboxing. Games and apps run in a sandbox, separated from the studio and from your account.

Limited access. Staff access to user data is limited to what is needed for their role and is logged.

Abuse controls. Rate limits, per-network build limits, platform-wide safety caps and automated abuse detection protect the service.

Our providers. We use established providers for hosting, AI, sign-in, email and payments, under contracts that include security and confidentiality obligations.

We do not claim any security certification (such as SOC 2) today. Businesses with security questions can open a ticket at /support under "Business and teams".

2. Keeping your account safe

Keep the Google account you sign in with secure, for example with 2-step verification.

Never share your Google password or verification codes, and do not put secrets, passwords or keys into prompts or project code.

Lumy staff will never ask for your password, verification codes, card number or keys.

If you believe your account is compromised, report it straight away with a Security report.

3. Reporting a vulnerability

Report security issues with a Security report ticket. Please include:

a description of the issue and its possible impact;

the affected page, feature or address;

clear steps to reproduce it, with any proof of concept; and

how we can contact you.

4. Scope

In scope: luminary.gg and its subdomains, the Lumy studio, the Lumy sign-in, support, help agent and publishing systems, and the built-in game and app backend.

Out of scope:

projects built and published by users (report harmful projects at /abuse; report a bug in your own project through the studio);

third-party services, including sign-in providers, payment providers and services you connect;

findings from automated scanners without a demonstrated, exploitable impact;

missing security headers, cookie flags or best practices without a demonstrated impact;

clickjacking on pages with no sensitive actions, self-XSS, and issues that require a compromised device or browser;

rate limiting or brute force on non-sensitive endpoints;

denial-of-service, spam and social engineering;

vulnerabilities in outdated browsers.

5. Rules of engagement

When researching, you must:

only test against your own accounts and projects, or accounts you have explicit permission to use;

never access, change, download, delete or keep other people's data. If you encounter it by accident, stop, do not share it, and tell us in your report;

not degrade, disrupt or overload the service, and not run denial-of-service or high-volume automated tests;

not use social engineering, phishing, spam or physical attacks against users, staff or providers;

not use prompt injection to attack other users or to extract and publish our system instructions or kit; limited, non-destructive testing of our own safety measures, reported to us promptly, is allowed;

not exploit an issue beyond what is needed to prove it;

give us reasonable time to fix the issue before you share any details with anyone else, and not share them without our agreement; and

follow the law.

6. Safe harbour