Responsible disclosure & bug bounty policy

Scope

What we pay

Rewards cover demonstrated impact on our systems or our customers. Amounts are in USD.

What we do not pay for

The highest we accept these at is Low or Informational. We read them and fix the ones worth fixing, but we pay no bounty, even when the report says Critical or High.

• Session still valid after logout or a password reset or change, until the token expires
• CSP, HSTS, X-Frame-Options or Referrer-Policy headers that are missing or “weak”, with no exploit that works
• Clickjacking on any page that has no sensitive action
• Cookie attributes for cookies that aren't used for sessions
• Listing out emails or usernames, including through response timing or error messages
• Remarks on the login, forgot-password or rate-limit behavior without a proven account takeover
• Personal views on password policy, like length, complexity, common-password lists and no forced rotation
• Not having two-factor authentication, or having 2FA as optional
• Self-XSS or XSS triggered only by the attacker inside their own session
• CSRF on the login, logout, language or another non-sensitive form
• Open redirects that give away no token or credential
• Software version, server banner, stack trace or path info that holds no sensitive data
• SPF, DKIM or DMARC configuration reports
• Output of automated scanning tools with no proof of concept
• Denial-of-service or resource-exhaustion tests, brute force, or any test that makes load
• Tricking our staff or customers through social engineering or phishing; physical attacks
• Issues with the third parties we use, for instance payment processors, Telegram, Cloudflare or email providers
• Older library versions without an exploit that works against our deployment
• Attacks where you first need a rooted phone, a compromised device or a man-in-the-middle position
• Best-practice recommendations, theory-level risks and copies of known issues

Rules of engagement

1. First valid report wins. We pay nothing for duplicates or for issues we already knew about. Only one payment for each root cause, even if it affects many endpoints.
2. Prove it, then stop. Access only your own accounts and data. Stop at the first proof and report if a test would expose someone else's data, and do not pivot, download or persist.
3. Do not degrade the service. You may not load test, fuzz automatically at volume, or test proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
4. Give us time. Publishing has to wait for our fix and for 30 days to pass. We tell you when the fix is out.
5. Severity is ours to set. We look at impact on our own systems and take the Bugcrowd Vulnerability Rating Taxonomy as the reference. We choose payment amounts at our discretion within the ranges above and send them by PayPal or USDT.

Policy last updated 2026-10-10.