Trust & Security
Last updated: October 25, 2026
On this page
Overview
Use this page to confirm official LowLighter services, understand how releases and billing are delivered, or report a security concern.
Official services
LowLighter LLC operates the following public services. Account credentials should only be entered on the official website or in the signed desktop application.
- lowlighter.ai — website and account portal
- api.lowlighter.app — application and account API
- downloads.lowlighter.app — release and product media delivery
Release verification
Windows installers are code-signed. Public macOS releases are code-signed and notarized by Apple before distribution. Download releases only through the LowLighter website.
If your operating system reports an unknown publisher or an unverified release, stop the installation and contact support.
Official downloads →Accounts and billing
Payments and subscription management are handled through Stripe-hosted checkout and billing pages. LowLighter does not collect or store full payment-card numbers on this website.
LowLighter support will never ask for your password, email verification link, or password-reset link.
Report a security issue
If you believe you found a vulnerability in LowLighter, email a concise description, the affected URL or app version, reproduction steps, potential impact, and any data you accidentally encountered. Remove secrets and unnecessary personal information from your report.
security@lowlighter.ai →Scope
This policy covers the LowLighter-owned services listed on this page and current public Windows and macOS releases obtained from our official downloads. Third-party services, customer-controlled systems, and unsupported builds are outside scope and should be reported to their respective owners.
Testing guidelines
Use only accounts and data you own or have permission to test. Limit testing to what is necessary to confirm the issue, and stop if you encounter another person’s data.
Do not access, modify, or delete another person’s data; disrupt service availability; perform high-volume automated scanning; use malware, credential attacks, or social engineering; test physical systems; or target third-party providers.
What to expect
We review each report and, when practicable, acknowledge receipt, validate its impact, prioritize a response, and share meaningful updates. Resolution time depends on the issue’s severity and complexity. Submitting a report does not create a right to payment; LowLighter does not currently operate a public bug-bounty program.
Coordinated disclosure
Keep vulnerability details private while we investigate. Work with us on a reasonable disclosure timeline that accounts for severity, exploitation risk, and remediation complexity.
Good-faith research
When you make a good-faith effort to follow this policy, LowLighter considers your research authorized for the systems in scope and does not intend to initiate legal action based solely on that research. If you accidentally exceed this policy, stop testing, avoid further access, and tell us promptly so we can evaluate the activity in context. This statement does not bind third parties or authorize violations of law.
Our machine-readable disclosure contact is available at /.well-known/security.txt.