Resolved Security Vulnerability

On November 21, we became aware of an individual who claimed on X that he had discovered a vulnerability on Lemon Squeezy which allowed him to access Lemon Squeezy user data. The individual displayed one Lemon Squeezy user's sales numbers on X to substantiate his claim.

We promptly brought the individual into our bug bounty program. The bug bounty report revealed a vulnerability in two of Lemon Squeezy’s API endpoints that allowed the individual to gain access to certain Lemon Squeezy user data. This data included information about users’ stores (sales volume, product description, etc.), as well as the users’ names and email addresses. The individual did not access more sensitive data, such as Social Security numbers, bank account information, or transaction details. 

The individual fully cooperated with us, confirming the deletion of all accessed data in accordance with our bug bounty program terms. There is no ongoing threat to our users as a result of this vulnerability and the vulnerable API endpoints have been appropriately remediated.  

We have directly contacted all users whose data was accessed by the individual. If you have not received a communication from Lemon Squeezy, your data was not accessed through this vulnerability.