Commitment to Security
Security is our highest priority at LastPass, including quickly responding to and fixing reports of material bugs or vulnerabilities. LastPass is in part able to achieve a high level of security for our users by looking to our community to challenge our technology. We appreciate the important work that the security research community provides and appreciate responsible disclosure of issues. Further, we believe that when the security process works as designed, we all benefit.
Note: If you are a LastPass user and you're concerned that your account has been hacked, compromised, or is otherwise at risk, please contact the LastPass support team. We will review and escalate your issue appropriately.
Submitting a Security Report
If you're a security researcher and believe you have found a security bug or vulnerability with LastPass, please follow these steps:
- Read the LastPass Security FAQs to make sure your concern hasn't already been addressed.
- Submit your report via our BugCrowd bug bounty program to report issues.
- Include a code sample and screencast demonstrating the exploit whenever possible.
- Clearly show how the bug or vulnerability impacts user data or LastPass systems.
- Allow us sufficient time to review and respond to your report, and coordinate with us for review and approval before any public posting of your findings.
- Refrain from accessing, modifying, or stealing user data, as well as disrupting the availability of LastPass (including a DDoS attack).
When reporting potential issues, please provide us enough information to recreate your findings. Information may include exact steps to reproduce the bug, any links you clicked on, pages you visited, URLs, and any affected account email addresses. Please include a code sample and either images or a video recording that clearly demonstrates the suspected exploit you have found.
To encrypt sensitive information, you can use this public key:
display public key
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.12 (GNU/Linux)
mQINBFRbmIEBEADRJNnM4zOZAXZa+STtZU1P84DIaHuvkwTIvwJgM8uEvsPPte8b
RGGFsH8TgosVEORXtPlumd+kNtZvncpMIE0FBnQ4NmX+guHKG/mVE9mDmRn5Qxad
TCZBZ/t/G0ZCZHZvdNyJjKPDq1SyN2ZeXPg+yfZkE8mQNS27NjFw2dtE/fzvBHaA
+OcH5Lj5Jyhd2oKNGIO9ipknmOb3uSYY+KZoTHUAo95J4PKJLAk6EK6d3vGhyNOZ
ssOu/lwq7FbNcahuP0WN+Hot1qxUwfGiOHJNEyz9Dq/kDMfgulANap+wkDtzrqN8
PhjkoZcYEW3iRlAybNS2g7mOjqRi1223zR6lEWjJ7alk08Ae6ahoKO1ZNYAGos5z
R+G2Vs6rN6omjYQEjZSUcanlr+StQFmN36GwxjAFLVFqYTnqB4BW6yuA5DJUxbJ0
Cr/b8GLwXYVTmZzkj3PVuvgVf68s4bK+fGkoqdLP9SVBKePGzUCWcLIv0+Jr4I8n
or9rvVXUxnzzVBXK/isrGclyVxFmIGNsrM+Apcs6Jk6JDDGb+VLcgcmcSShPsLbr
LvheOUeA9dqBmcnnJiQorJ5ht8xGe8hpy150BZVaU2CJkj5R7IMle2SNBrlaA+FX
3R9oSRaFYtmlcayqmnlPEWR5x7mhKuawuIhffvOefikT0YApQI8gITRp2wARAQAB
tC5MYXN0UGFzcyBTZWN1cml0eSBUZWFtIDxzZWN1cml0eUBsYXN0cGFzcy5jb20+
iQI9BBMBCgAnBQJUW5iBAhsDBQkJZgGABQsJCAcDBRUKCQgLBRYDAgEAAh4BAheA
AAoJEDPqE9cwQ3hUqK0QAKTSyv60uESScgabtjeHEo7GsWWnDEPZprTZaSBrhPq5
4XQWFk7e9fRwe/guucJt1A6CGf0Kpnc1SBHfMUV6Z91sV4syE5p/o0gW3gAlmxIl
T6zSJUvHVlxN1f+9Ae3WmlwgMA/L5zzBOGk2Cm4OedBVQmf+KZGwq/5CSwrX2k+S
h8xGgDNO8zv7+eNSBS7556pcBGRY1EQ/FvPpL/ACCI7fDSAj5rYOn94Kq8ebdeBZ
X8n9mvREKEbSmSkU/+t8cxWOIMPT0LUXI4Ev8Bn+c5KPKUx3IS+hMSHThWOQJcWL
CSOss7gywby02ejSDRfQ3Z4pMA2JaBrNu2GiBmyXzYLFKsoIN2Wlvzyo54mul2LV
alrEjwNSk2jxnMsCkaQZyBwnGH/nxzAWalLfAaU4Yk48sT0//Iep/i0Psz+X5btg
SZr/jJcQuy6SZpM2yqsDW6+eYMUtqGp89Lez0JauMrxL/2c3kypw3/QVB88ava4P
1f+dFtV23eNIFKQhxfp9V8ZVcxxWfsPk4roF3SV1BROr9zpa2h6rrOXSrmgbGQpI
TvEKLInuIcB8QzuuswkX5Lmg35mKGgNwj/QKRfmPn71YkaEpJ2ZLdGJPQ3028ozX
fdQ757dAGovq0lLnr1sI5ez+QhAAtubprd1lhDKW0TWjif0iOpLHthZUixp+2Up8
uQINBFRbmIEBEAC+hazKNyvlwSmV2tWK1UkpYDmzDdZrfUH8RcTQRbES23tB+rAY
XCJ7XIWDFdaobmmnP70PJ6rRzvfkvY4jazi/fc84vIKanh1K0o+/9LpaBkrtbZ40
uhTsHFXDqnpnc7mEbkWaABbsD3ggPgWynnQordhXtyBGSpkMaUk2luV/Ct5GVJog
Q38D87sveVIEckpBRom2GEkQUqXQdt+WCutL6bRnI0LoebPry0wlim9ZYOxBFaJr
DwRtWqcLmdUmx+SCpiAmKCG+qfrYoL3LJrYcJjvskRXowJOC2BS659nhmi4bBptz
H1vRDtttejBi2h/KRf+epbrkF1ES7NO/A5/zaH3B8BLbFLwjOQlJ9SwpgM1aGggD
CQyJ2aGfqC4iffro0L8673mx/7mgT5DJsO6duXRZP7ty6aF765Fn/Reh4g8cZhBz
XftzuLqd6Wb7ET0BxkDOeOz4b87WzQ7d1iz2qTqOXwyaxANJAINDyKm9b7oTs7k9
2cZc3N1dyyegCROVAWDS58zUSihyl7Cmq5V8uRUpz04jhe4v+IOK4KdzeMNwe/Lo
l4sssoBbmzj8Xet2TriEY0oMRh5hQHWSghLU7BrZvS4qEDDabJHGThym332MdDkQ
NezwxYt9SeiFwRyz2onUiBNzww6nFpuVv8xCYVYURUAv5eaVoHq9G6W82QARAQAB
iQIlBBgBCgAPBQJUW5iBAhsMBQkJZgGAAAoJEDPqE9cwQ3hUC0cQAKCemgzjGXK7
vwqExQTgKbytbS3+Diie+9yIcCXv/EYViFVatnjHp1tltpOcwUvaVBpJ8Vxj0p+y
y9V5cZA1I1jTcVxnV5Qnje+Xw4mgpN1ooWC3ZKJVZ/TTW95IjV19PbsWYwM+FsGs
Dm7GgjP+6/XqSg0EXBplCPueOQjRhtwtbxUIw6p3DF2Ueska+UdCNvE0wjLZirNM
h9jUn3strA/tQ2MNluF7u/di15Z3W4wHdeXx3JV4ccjxFDPX27aP7E/+vRMogc1u
aPzC/Qjhm4PrZuo1UYI4ZveRjZlpTd4WT5/kD+zVkttv9MRiH8eS6UpDBTOVDkmh
2FW0EiacCEP01Ws5iDeF4WGcBhdXoHpWw+Aj/0HE7Tz1kfzAsMUhlXCNtKB6BEvX
YLaEQyRJwHC8vfriZ6uTxfz1Kkyr6/iRxLKCfRmu3DhpC/H8bpKcEgslqseQ3PlT
2K70m1xBcbkrQRAZkjZ9kbgny28ogKzYHrmeazrLCVPGLm9DxGvjTG9VCpVEdrg9
cbY3ajrHSgXEXh9VlTmIcrs2z9JgLD65V0wN0N8yKA9cBwUb/b77WIwdwQ1crQ+M
Q9ZsNE+rzOhLgnSRHInrbM+prjI8ejxOj3UbAJWhZwqwPV7eVUBwl5hrzG6HN3E9
G+0VDkYx8QGax0PeiKAFd0Dr5+PNyjTr
=ZmTr
-----END PGP PUBLIC KEY BLOCK-----
Note: If you are using automated tools to find vulnerabilities, please be aware that these tools frequently report false positives.
Responding to Reports
Once we receive a report, we will take steps to investigate the report and determine its severity. If we attempt to fix the identified issue, contingent on its severity, we may contact you for additional information. We will deploy necessary fixes to affected users based on the issue's severity and potential impact. We will close the report once an is resolved or otherwise determined to be closed.