Responsible disclosure & bug bounty policy

Scope

What we pay

To earn a reward, demonstrate impact on our systems or our customers. Amounts are in USD.

What we do not pay for

These get accepted as Low or Informational, at the very most. We read them and take care of what is worth fixing, but no bounty is issued, and a Critical or High label on the report will not change that.

• A session that outlives a logout, a password reset or a password change, lasting until token expiry
• Security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) missing or “weak” where no working exploit exists
• Clickjacking of a page offering no sensitive action
• How attributes are set on cookies that are not session cookies
• Email or username enumeration, error messages and timing included
• Observations on login, rate limits or forgot-password with no account takeover demonstrated
• Takes on password policy: length, complexity, common-password lists, no forced rotation
• Two-factor authentication absent, or 2FA set as optional
• XSS that the attacker can only trigger in their own session (Self-XSS)
• CSRF on a login, logout, language or other non-sensitive form
• Open redirects, unless they leak a token or credential
• Disclosure of software versions, server banners, stack traces or paths lacking sensitive data
• SPF, DKIM or DMARC configuration reports
• Whatever an automated scanner outputs, without a proof of concept
• Denial-of-service and resource-exhaustion tests, brute force, or any test that creates load
• Physical attacks; social engineering or phishing of our customers or staff
• Issues with any third party we use: payment processors, Telegram, Cloudflare, email providers
• Libraries on outdated versions with no working exploit against our deployment
• Attacks relying on a rooted phone, a compromised device or being man-in-the-middle
• Best-practice notes, theoretical risks and duplicates of issues already known

Policy last updated 2026-10-10.

Rules of engagement

1. First valid report wins. Duplicates and reports covering issues we already know about are unpaid. Multiple affected endpoints with the same root cause still mean one payment.
2. Prove it, then stop. Access only your own accounts and data. Stop at the first proof and report whenever a test would expose someone else's data — no pivots, downloads or persistence.
3. Do not degrade the service. Proxy gateways, modem hosts and carrier networks are not to be tested, and neither load testing nor automated fuzzing at volume is allowed. Those are out of scope entirely.
4. Give us time. Don't publish until the fix is done and 30 days have gone past. We will confirm to you when a fix is live.
5. Severity is ours to set. We look at impact on our own systems and rate it with the Bugcrowd Vulnerability Rating Taxonomy as the reference. Payment is by PayPal or USDT, and the amount is at our discretion within the ranges above.