Responsible disclosure & bug bounty policy

Scope

What we pay

Rewards depend on demonstrated impact on our systems or our customers. Amounts are in USD.

What we do not pay for

These rate Low or Informational at most when accepted. We do read them and fix what's worth fixing, but no bounty is issued, regardless of a Critical or High label on the report.

• Old sessions still working after a password change, password reset or logout, until the token times out
• A missing or “weak” security header (CSP, HSTS, X-Frame-Options, Referrer-Policy) without an exploit that works
• Clickjacking on pages where no sensitive action exists
• Cookie attributes on any non-session cookie
• Discovering valid emails or usernames, including through timing or error messages
• Login, rate-limit or forgot-password observations missing a demonstrated account takeover
• Password-policy opinions on length, complexity, common-password lists or no forced rotation
• Optional 2FA, or two-factor authentication that does not exist
• Self-XSS, or XSS nobody but the attacker can trigger, in their own session
• CSRF hitting login, logout, language and other forms that are not sensitive
• Open redirects that don't leak tokens or credentials
• Stack traces, paths, server banners or software versions shown without sensitive data
• SPF, DKIM or DMARC configuration reports
• Automated scanner output missing a proof of concept
• Load-generating tests of any kind, denial of service, resource exhaustion or brute force
• Phishing our staff or customers, social engineering them, or physical attacks
• Anything wrong inside third parties we use: email providers, Cloudflare, Telegram, payment processors
• Outdated libraries lacking a working exploit against our deployment
• Any attack that needs a compromised device, a rooted phone or a man-in-the-middle spot to work
• Theoretical risk, best-practice advice and duplicate known issues

Policy last updated 2026-10-10.

Rules of engagement

1. First valid report wins. No payout for duplicates or reports of issues we already know about. A root cause pays out once, however many endpoints it reaches.
2. Prove it, then stop. Access only your own accounts and data. Once a test would expose another person's data, stop at the first proof and report — no pivot, no download, no persisting.
3. Do not degrade the service. Leave out load testing, volume automated fuzzing and any tests against proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
4. Give us time. No publishing until the issue is fixed and 30 days are up. You get word from us when a fix is live.
5. Severity is ours to set. Impact on our own systems is what we rate, taking the Bugcrowd Vulnerability Rating Taxonomy as the reference. Payouts are paid by PayPal or USDT, in amounts at our discretion within the ranges above.