Security & Vulnerability Disclosure

Last updated: October 2026

We take the security of our SDKs, services and customers seriously. If you believe you have found a security vulnerability in an IMG.LY product or service, we want to hear about it, and we will work with you to understand and resolve it.

How to report

Email security@img.ly. Reports in English or German are welcome. Please include:

• the affected product, service or URL, and the version where it applies,
• a description of the issue and its impact,
• clear steps to reproduce it, or a proof of concept,
• how we can reach you for follow-up questions.

Our machine-readable contact details are published at img.ly/.well-known/security.txt.

In scope

• The CreativeEditor SDK, PhotoEditor SDK and VideoEditor SDK, and IMG.LY CoDesign
• img.ly and its subdomains operated by IMG.LY, including the customer dashboard and our APIs
• The IMG.LY AI gateway and license services

Out of scope

We receive many automated reports that do not describe an exploitable vulnerability. The following are not accepted as vulnerabilities, unless you can demonstrate a concrete, practical impact on our users or data:

• Output of automated scanners without a working proof of concept
• Missing or “best practice” DNS and email settings, such as CAA records, MTA-STS, TLS-RPT, DNSSEC, or SPF, DKIM and DMARC policies
• Missing or misconfigured HTTP security headers, cookie flags without a demonstrated impact, or TLS cipher and protocol preferences
• Clickjacking on pages without sensitive actions
• Self-XSS, logout CSRF, or CSRF on forms that change nothing sensitive
• Rate limiting, brute force or enumeration findings without a demonstrated impact
• Version disclosure, banner grabbing, or descriptive error messages
• Vulnerabilities in third-party services or software we do not control
• Issues that require a compromised device, physical access, or social engineering
• Denial-of-service attacks, spam, and volumetric testing

Rules for testing

• Only test against accounts and data you own, or have explicit permission to use.
• Do not access, change, delete or keep data belonging to others. If you encounter such data, stop and tell us.
• Do not degrade or disrupt our services. No denial-of-service, load or automated mass testing.
• Do not use social engineering, phishing, or physical attacks against our staff, offices or customers.
• Give us reasonable time to fix the issue before you disclose it publicly, and coordinate the disclosure with us.

What you can expect from us

• We acknowledge your report within 5 business days.
• We keep you informed while we investigate and fix the issue.
• We let you know when the issue is resolved, and with your permission we credit you for the discovery.

Safe harbor

If you act in good faith and follow this policy, we will consider your research authorized, we will not pursue legal action against you, and we will not report you to law enforcement. If a third party takes legal action against you for activities that followed this policy, we will make it known that your actions were authorized by us.

Rewards

We do not run a paid bug bounty program and do not pay for reports. Please do not make a report conditional on payment. We are grateful for responsible disclosures and are happy to credit researchers who help us improve our security.