Security & Vulnerability Disclosure

Last updated: August 4, 2026

We take the security of LotCast, our dealers' data, and buyers' information seriously. If you've found a security vulnerability, we'd rather hear about it from you first.

How to report

Email [email protected] with a description of the issue, steps to reproduce it, and any relevant request/response details. Please don't include real dealer or buyer data in your report if you encounter any while testing — describe it instead.

What to expect

We'll acknowledge your report within 3 business days.
We'll investigate and let you know if we can reproduce the issue and how we're prioritizing a fix.
We'll let you know once it's resolved, and are happy to credit you (with permission) once the fix is live.

Good-faith research

We won't pursue legal action against anyone who discovers and reports a vulnerability in good faith, provided you:

Avoid privacy violations, data destruction, or service disruption while testing.
Don't access, modify, or exfiltrate more data than necessary to demonstrate the issue — a proof of concept is enough.
Give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly.
Don't use automated scanners against production in a way that degrades service for dealers or buyers — reach out first if you want to run one.

In scope

lotcast.ai and api.lotcast.ai, including the MCP/agent API endpoints, the dealer dashboard, and the admin panel.

Not a bug bounty

We don't currently run a paid bug bounty program. We're grateful for good-faith reports regardless, and will credit researchers who want public acknowledgment.

Contact

Security issues: [email protected]. Everything else: [email protected].