Security at Lifted Holdings
We build and operate payment, point-of-sale, vending and signage systems. This page is where we publish what we find, and how to reach us if you find something.
Report a security issue
Email will@liftedholdings.com. We aim to acknowledge within one business day. Machine-readable contact details are published at /.well-known/security.txt, and our handling commitments are in the vulnerability disclosure policy.
We do not operate a paid bug bounty. We do credit reporters who want credit, and we will not pursue legal action against good-faith research conducted within the policy.
Advisories
Findings from our own investigations, published with full indicators so other defenders can act on them. See all advisories.
LH-2026-005 · 2026-10-22
A three-day abuse campaign against our self-serve sign-ups
An incident report about our own systems: a 29-minute outage caused by a connection leak of ours, and an unsuccessful DNS-rebinding attempt through e-signature webhooks. No evidence that customer data was reached. Includes the mistakes it exposed and how we fixed them.
LH-2026-004 · 2026-09-08
A recruiter-supplied “MVP” repository carried a Node.js backdoor
An invitation to review a startup’s MVP before a meeting. The repository posts the machine’s entire environment to a hidden endpoint and executes the reply as code, firing from the start command its own README recommends. Includes the execution trace, the concealment analysis, a behavioural YARA rule, a pre-install triage script for anyone asked to look at a stranger’s repository, and an account of the one step in our own analysis that went further than the plan allowed.
LH-2026-001 · 2026-08-06 · updated 2026-08-12
Credential-phishing campaign distributed from a compromised AirDroid (Sand Studio) mailbox
A two-stage adversary-in-the-middle phishing kit delivered by mail that passed SPF, DKIM and DMARC from a vendor's own domain. Includes full indicators, the disclosure timeline, and an explicit statement of what the evidence does not establish. Updated 2026-08-12 with Sand Studio's vendor response — concluded. Sand Studio reports initial access via a phishing mail to one of its own employees and unauthorised access limited to that single mailbox, and on 2026-08-12 published a security notice on its own domain — the first statement about the incident to reach us on a surface the compromised mailbox does not control. Our incident response is closed; no finding or indicator was changed.
How we handle incidents
Three commitments that govern everything on this page:
- We publish indicators, not accusations. Advisories state confidence levels and separate what was observed from what was inferred. Every advisory carries a section describing what we could not establish.
- We notify affected parties before we publish. Where a vendor or third party is involved, they hear from us first, and we say when and how in the advisory itself.
- We do not overstate scope. If we can demonstrate that one account was affected, we say one account — regardless of how large the surrounding organisation is.
Our own posture
Lifted Holdings operates in payments. Card data handling is scoped to validated service providers and gateway-hosted fields; we publish no claim about a certification we do not hold. Questions from customers, partners and underwriters about our controls should go to will@liftedholdings.com.