App Store

Google Play Store

Download the app

About

Careers

Partner with Us

Corporate Sales

Press

Investor Relations

Trust & Safety

Sustainability

Learn

Enterprise Tracking Partnership

Company

Help Center

Activate a Tile Tracker

Blog

Member Protection

Order Status

Shipping

Warranty & Refund Policy

Report a Security Vulnerability

Support

Terms of Service

Privacy Policy

Law Enforcement Guidelines

Reseller Policy

US UPP

Canada UPP

Declaration of Conformity

Legal

<ul><li>A security vulnerability IS any weakness in our apps, devices, APIs or infrastructure that could impact user privacy, safety, or the correct functioning of our products. </li><li>A security vulnerability is NOT a request to delete information, cancellation of services, or for assistance in a personal matter, etc. </li><li>For non-security vulnerability issues, please visit our Help Center at <a href='https://support.life360.com' target='_blank' title='Opens in a new tab'>support.life360.com</a>. Please see FAQ #2 - What does this apply to? For more details of what is inside and outside of scope. Life360 welcomes the support of the security research community and independent researchers to responsibly identify and report security vulnerabilities. Our mission is to reduce business risk and enhance the safety and security of the people who rely on our digital and physical products.</li></ul>

You can report security issues related to all Life360-branded and affiliated products, including:<ul><li>Life360 mobile and web applications</li><li>Life360 hardware, as well as our:<ul><li>Tile Bluetooth trackers</li><li>Jiobit smart location devices</li><li>Life360 Nativo web applications</li><li>Life360 Nativo public SDKs</li></ul></li></ul>The following systems and assets are in scope for vulnerability research and disclosure (non-exhaustive list):<ul><li>Websites<ul><li>https://www.life360.com</li><li>https://www.jiobit.com</li><li>https://www.nativo.com</li></ul></li><li>APIs<ul><li>api.life360.com</li><li>production.tile-api.com</li><li>backend.jiobit.com</li><li>api.nativo.com</li></ul></li><li>Android<ul><li>com.life360.android.safetymapd</li><li>com.thetileapp.tile</li><li>com.jiobit.app</li></ul></li><li>iOS<ul><li>Life360-find-family-friends</li><li>tile-find-lost-keys-phone</li><li>jiobit-for-families</li></ul></li><li>All firmware, applications, APIs, and cloud services associated with Life360, Jiobit and Tile devices</li></ul>In-Scope Vulnerability Categories:<ul><li>Authentication or authorization issues</li><li>Unauthorized access to users&#39; data or location</li><li>Server-side vulnerabilities (e.g., RCE, SQLi, SSRF)</li><li>Mobile client PII leakage</li><li>Directory traversal, XSS, and CSRF in sensitive functions</li><li>Insecure Direct Object References (IDOR)</li><li>API logic flaws</li><li>Exposure of sensitive credentials or tokens with demonstrated impact</li><li>Misconfigurations with demonstrated security implications</li><li>Membership and payment flaws (i.e. can you become a platinum member without paying beyond a free trial period).</li></ul>Out of Scope Vulnerability Categories: Certain vulnerabilities are considered out-of-scope for the Bug Bounty Program. Those out-of-scope vulnerabilities include, but are not limited to:<ul><li><a href='https://docs.hackerone.com/en/articles/8494488-core-ineligible-findings' target='_blank' title='Opens in a new tab'>https://docs.hackerone.com/en/articles/8494488-core-ineligible-findings</a></li><li><q>Scope Exclusions</q> as listed on HackerOne</li><li>Systems from recent merger and acquisition within 60 days of completion</li></ul>Known Issues (Not a comprehensive list)<ul><li>Account phone/email signup verification (we do not use traditional 2FA)</li><li>Known vulnerabilities (CVEs) without a proven exploit in our environment</li></ul>Other<ul><li>Any physical attacks against Life360 property or data centers</li><li>Social engineering of employees, contractors, or vendors</li><li>Injection (HTML, CSV) without demonstrating a vulnerability and PoC exploit</li><li>CSS Injection attacks (Unless it gives you the ability to read anti-CSRF tokens or other sensitive information).</li><li>Automated scan reports without validated reproducible impact</li><li>Including from AI scan tools without validation of exploitability and impact</li><li>Previously known vulnerable libraries or frameworks without a working proof of concept and exploit</li><li>Known vulnerabilities with patches &lt;30 days old</li><li>Vulnerabilities only affecting users of outdated mobile applications</li><li>[less than 2 stable versions behind the latest released stable version]</li><li>Vulnerabilities only affecting users of outdated or unpatched browsers</li><li>[less than 2 stable versions behind the latest released stable version]</li><li>API credentials or key exposure without a proven business risk. Do not use an API key to run up the bill. This type of issue is not eligible for rewards.</li><li>Presence/Lack of autocomplete attribute on web forms/password managers</li><li>Rate limiting or bruteforce issues</li><li>Unused HTTP methods or response codes used</li><li>Private IP/Hostname disclosures or real IP disclosures for services using CDN</li><li>Mobile related issues including <q>secrets</q> found within the application must have an associated business risk of abusing those secrets</li><li>Vulnerabilities involving stolen credentials</li><li>Full Path Disclosure</li><li>Password complexity requirements, account/email enumeration, or any report that discusses how you can learn whether a given username or email address is easy to guess</li><li>WordPress admin endpoints exposed without working Proof of Concept exploit</li></ul>

We take security very seriously. If you believe you’ve discovered a security vulnerability in any of our products or services in scope, please report it through one of the following channels:<ul><li>Submit your report through our HackerOne program at<a href='https://hackerone.com/life360' target='_blank' title='Opens in a new tab'> https://hackerone.com/life360</a>. If you need an invitation, email your complete report to <a href='mailto:responsibledisclosure@life360.com'>responsibledisclosure@life360.com</a> and we&#39;ll get you set up</li><li>Alternatively, If you&#39;re unable to use HackerOne, you can email your report directly to <a href='mailto:vulnerability-disclosure@life360.com'>vulnerability-disclosure@life360.com</a></li></ul>For non-security vulnerability issues, please visit our Help Center at <a href='https://support.life360.com/' target='_blank' title='Opens in a new tab'>support.life360.com</a>.To help us investigate efficiently, please include the following in your report:<ul><li>Product name and version (e.g., Life360 app, Tile Mate device)</li><li>A clear description of the vulnerability</li><li>Detailed steps to reproduce the issue</li><li>Date of Discovery</li><li>Your contact information (optional but recommended for follow-up)</li></ul>We’ll only use your information to investigate and respond to the issue.

We aim to respond in a timely and transparent manner.Here’s what you can expect:<ul><li>We will acknowledge all submissions within 10 business days. </li><li>If a submission is determined to be a valid security vulnerability, we will provide further updates to you and may request additional details within 30 days. </li><li>Progress updates will be provided through the lifecycle of the concern until resolution is reached if it is determined to be a valid security vulnerability. </li></ul>If, after review, we determine that a submission does not meet our criteria for a valid security vulnerability, we may not follow up beyond the initial acknowledgment. For non-security vulnerability issues, please visit our Help Center at <a href='https://support.life360.com/' target='_blank' title='Opens in a new tab'>support.life360.com</a>. Life360 reserves the sole discretion to determine the nature, severity, and resolution timeline of any reported vulnerability, and to decide whether and how to respond to a report. Nothing in this FAQ obligates Life360 to take any action beyond what is legally required, nor does it create any contractual or legal rights for any party. Life360 may update or amend these FAQs at any time without notice. Engagement with this program does not guarantee any form of response, remediation, or recognition, unless legally required.

When you are preparing to submit your vulnerability report, please keep in mind the following guidelines:<ul><li>Submit all reports privately via the mechanisms listed in the section <q>How can I report a security vulnerability?</q></li><li>Submit clear, reproducible reports; vague or incomplete submissions may be rejected</li><li>Test only systems and assets (described above) explicitly in scope and do not expand access beyond the verified issue</li><li>Do not target third-party services and limit automated tools to 60 requests/sec, always ceasing automated activities at the first sign of outage or adverse impact</li><li>Report one vulnerability per submission (unless chaining of related vulnerabilities is required)</li><li>Only the first valid report is eligible for recognition; duplicates or derivative issues may be grouped</li><li>Immediately stop testing and report if you encounter Personally Identifiable Information (PII), protected intellectual property, or adversely affects shared services</li><li>Social engineering, phishing, and physical access attempts are prohibited</li><li>Use only test accounts you own or are authorized to use; never use real user data (even if it is your own)</li><li>Trial or paid memberships may be used to access premium features for testing. To support your research:<ul><li>Create test accounts with valid credentials and a legitimate phone number</li><li>You may use trial or paid memberships to access premium functionality</li></ul></li></ul>Life360 reserves the sole discretion to determine the nature, severity, and resolution timeline of any reported vulnerability, and to decide whether and how to respond to a report. Nothing in this FAQ obligates Life360 to take any action beyond what is legally required, nor does it create any contractual or legal rights for any party. Life360 may update or amend these FAQs at any time without notice. Engagement with this program does not guarantee any form of response, remediation, or recognition, unless legally required.

<ul><li>If you are not satisfied with the outcome or handling of your vulnerability report, you may escalate the matter by replying to the original email you received to reopen the issue.</li><li>Please include a clear summary of your concerns so we can conduct a thorough reassessment. </li><li>We are committed to ensuring that all reports are handled fairly, transparently, and in accordance with our disclosure policy.  </li></ul>

Any personal data collected (e.g. name, and email address) will only be used to process your security report and communicate with you about it.

Security Vulnerability Disclosure Reporting - Frequently Asked Questions (FAQs)

Security

Security Vulnerability Disclosure Reporting - Frequently Asked Questions (FAQs)

What is a security vulnerability?

What does the security vulnerability disclosure reporting FAQs apply to?

How can I report a security vulnerability?

When can I expect a response after submitting a security vulnerability report? Will I receive updates?

What guidelines should I follow when I am preparing my security vulnerability report?

I don’t think my security vulnerability report is being handled properly – what do I do?

How is my information included in my security vulnerability report handled?