Responsible disclosure & bug bounty policy

Scope

What we pay

A reward requires demonstrated impact on our systems or our customers. Amounts are in USD.

What we do not pay for

These are capped at Low or Informational. Each one is read and fixed if worth fixing, but no bounty is paid, whatever Critical or High label the report carries.

• Sessions that are not ended by a logout, password change or password reset and last until the session token expires
• Reports of missing or “weak” security headers such as CSP, HSTS, X-Frame-Options or Referrer-Policy, without a working exploit
• Clickjacking where the framed page offers no sensitive action
• The attributes set on any cookie that is not a session cookie
• Email or username enumeration, timing-based and error-message-based included
• Login, forgot-password or rate-limit findings where no account takeover is demonstrated
• Password policy preferences covering length, complexity, common-password lists and no forced rotation
• Missing two-factor authentication, or 2FA that users can choose to skip
• XSS limited to the attacker's own session, including self-XSS
• Cross-site request forgery on login, logout, language or other benign forms
• An open redirect that does not leak any token or credential
• Software version, server banner, stack trace or file path exposure that reveals no sensitive data
• SPF, DKIM or DMARC configuration reports
• Automated scanner reports that lack a proof of concept
• Any load-generating test, including denial of service, resource exhaustion or brute force
• Physical attacks, and social engineering or phishing of our staff or customers
• Issues that sit with third parties we use, like payment processors, Telegram, Cloudflare or email providers
• Library versions that are outdated but have no working exploit against our deployment
• Attacks only possible from a compromised device, a rooted phone or a man-in-the-middle position
• Recommendations from best practice, merely theoretical risks, and duplicates of known issues

Policy last updated 2026-10-10.

Rules of engagement

1. First valid report wins. Duplicate reports, and reports of issues we already know about, receive no payment. We pay once per root cause, however many endpoints are affected.
2. Prove it, then stop. Access only your own accounts and data. If testing would expose data that is not yours, halt at the first proof and report; do not pivot, download or persist.
3. Do not degrade the service. Do not run load tests or automated fuzzing at volume, and do not test proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
4. Give us time. Publication must wait until the issue is fixed and 30 days have passed. Once a fix is live, we will tell you.
5. Severity is ours to set. Using the Bugcrowd Vulnerability Rating Taxonomy as the reference, we rate the impact on our own systems. Amounts are set at our discretion within the ranges above, with payment made by PayPal or USDT.