Responsible disclosure & bug bounty policy

Scope

What we pay

Payouts track demonstrated impact on our systems or our customers. Amounts are in USD.

What we do not pay for

These land at Low or Informational, never higher. They get read and, where worth it, fixed, but no bounty issues, and a Critical or High label on the report changes nothing.

• A session token still accepted after logout, password change or password reset, up until it expires
• Header findings (CSP, HSTS, X-Frame-Options, Referrer-Policy missing or “weak”) lacking a working exploit
• UI redress (clickjacking) on pages lacking any sensitive action
• Attribute settings for cookies outside the session cookie
• Enumerating emails or usernames, including by timing or error-message differences
• Rate-limit, login or forgot-password observations lacking a demonstrated account takeover
• Password-policy feedback on length, complexity, common-password lists or the absence of forced rotation
• Lack of two-factor authentication, or 2FA not enforced
• Self-XSS and XSS triggerable solely by the attacker within their own session
• CSRF targeting non-sensitive forms: login, logout, language and the like
• Open redirect bugs that leak neither tokens nor credentials
• Version, banner, stack-trace or path disclosure that carries no sensitive data
• SPF, DKIM or DMARC configuration reports
• Automated scanner output lacking a proof of concept
• Denial of service, resource exhaustion, brute forcing or any test producing load
• Social engineering or phishing targeting our staff or customers, plus physical attacks
• Flaws in upstream third-party providers we use: payment processors, Telegram, Cloudflare, email providers
• Stale dependency versions with no working exploit against our deployment
• Attack paths that assume a man-in-the-middle position, a compromised device or a rooted phone
• Known-issue duplicates, theoretical risks and best-practice recommendations

Policy last updated 2026-10-17.

Rules of engagement

1. First valid report wins. Duplicate submissions and reports of already-known issues are not paid out. Payment is made once per root cause, not once per affected endpoint.
2. Prove it, then stop. Access only your own accounts and data. Where a test would expose another party's data, stop at the first proof and file the report; do not pivot, download or persist.
3. Do not degrade the service. Load tests, automated fuzzing at volume, and tests aimed at proxy gateways, modem hosts or carrier networks are all off limits. Those are out of scope entirely.
4. Give us time. Keep any public write-up back until the fix is in and 30 days have elapsed. We notify you when a fix ships to production.
5. Severity is ours to set. Impact is assessed on our own systems, referencing the Bugcrowd Vulnerability Rating Taxonomy. Payout amounts fall within the ranges above at our discretion and are sent via PayPal or USDT.