Lumos Studio Bug Bounty programme rules
Last updated: 2026-10-20
What the programme is
If you find a mistake in something we built on one of the Lumos Studio sites and tell us, we reward you: your first confirmed report wins a Lumos Studio T-shirt and a keychain.
The programme works like any bug bounty, but only for Lumos Studio: only problems that come from our own code and texts count.
What is in scope
The public Lumos Studio sites and applications:
- Lumos Studio (lumosstudio.ro)
- EduFin (edufin.lumosstudio.ro)
- Cerere (cerere.lumosstudio.ro)
- Anticipat (anticipat.lumosstudio.ro)
- Apocalink (apocalink.lumosstudio.ro)
- TaxaRO (taxaro.lumosstudio.ro)
- Scam Alert (scamalert.lumosstudio.ro)
- FonduRO (fonduro.lumosstudio.ro)
- ROptimizaRE (roptimizare.lumosstudio.ro)
- AirSpot (airspot.lumosstudio.ro)
The problems that count, when they come from code or texts we wrote:
- a feature that does not work (a button, a form, a calculation, an export);
- a wrong calculation or date in what we show;
- a broken or empty page, or one that shows an error because of our code;
- a display or accessibility problem we can reproduce;
- a broken link in our pages;
- a security vulnerability in our code.
What is out of scope
These do not count, however annoying they are:
- an outside service that is down or slow (hosting, database, e-mail, DNS, maps, the services of public institutions);
- vulnerabilities or errors in the libraries, frameworks and services we use: they are reported to whoever makes them, unless they are caused by the way we use them;
- problems of your browser or device (extensions, very old versions, settings);
- a mistake at the official source itself, not ours;
- suggestions for new features, opinions about design or prices;
- reports without steps, without proof or that cannot be reproduced;
- problems already known or reported by someone else before (duplicates) and those on sites that are not public yet;
- spam, mass automated tests, denial-of-service attacks, social engineering, accessing or changing other people's data.
Rules of conduct
- Test only with your own data; do not access or change other people's data. If you come across it by mistake, stop and tell us.
- Do not use a vulnerability beyond what is needed to prove it, and do not load the servers with mass requests.
- Do not make the details of a vulnerability public until we tell you it is fixed.
- Obey the law. If you follow these rules and act in good faith, we will not take action against you for the tests you made.
How to report
Press the “Report a problem” button on the site (the round one, bottom right), pick what it is about and describe what you saw, what you expected to happen and the steps to reproduce it. You write your email only if you want the prize; then you also tick the agreement to be contacted.
How we decide
We check every report. We confirm it if we can reproduce it, it is in scope and it is not a duplicate. If several people report the same problem, the first valid report counts. Lumos Studio's decision is final; we do not promise to answer every report, but we try to read all of them within a few days.
The prize
- One set (a Lumos Studio T-shirt and keychain) per person, for their first confirmed report; the person is recognised by the email address.
- No money is paid and the prize cannot be exchanged or handed to someone else.
- We contact you by email after the confirmation to learn the size and the delivery address. We deliver in Romania; for other countries we decide case by case.
- Prizes are given while stocks last. We can stop the programme or change the rules at any time; a report confirmed before the change keeps its prize.
Who can take part
Anyone aged 16 or over, or with a parent's agreement. People who work or worked on the Lumos Studio sites cannot win the prize.
Your data
The controller of the data is Lumos Studio, Roman, Neamț County, Romania; you can write to us at hello@lumosstudio.ro.
| What we keep | Why | For how long |
|---|---|---|
| The text of the report, the page, the kind of problem, the screen size, the browser type | To check and fix the problem (legitimate interest, Art. 6(1)(f) GDPR) | While we review it and 12 months after it is closed |
| The email address, only if you write it | To contact you about the prize (your consent, Art. 6(1)(a)), which you can withdraw at any time | Deleted once the prize has arrived, at once if the report is not confirmed, or on your request |
The report is stored on our content server (Supabase) and we also receive it as an internal Telegram notification, without your email address. Your rights (access, rectification, erasure, objection, withdrawing consent) and the complaint to the data protection authority are described in our privacy policy.
Liability and governing law
We do not guarantee that a confirmed problem is fixed by a given date. We are liable within the limits set by law. These rules are governed by Romanian law.
Contact
Questions about the programme: hello@lumosstudio.ro.