Responsible disclosure & bug bounty policy

Scope

What we pay

We give rewards for impact that is demonstrated on our systems or our customers. Amounts are in USD.

What we do not pay for

We will accept these at Low or Informational severity at most. We will read each one and fix whatever is worth fixing, but no bounty is issued, and marking the report Critical or High does not alter that.

• A session that is not closed when you log out, change or reset your password, and stays valid until the token expires
• Security headers such as CSP, HSTS, X-Frame-Options or Referrer-Policy being missing or “weak”, without a working exploit
• Clickjacking on pages where no sensitive action can be taken
• Attributes set on cookies that do not carry the session
• Telling which emails or usernames are registered, even through timing or error messages
• Observations about forgot-password, login or rate limiting that come without a demonstrated account takeover
• Opinions regarding password policy, including length, complexity, common-password lists, no forced rotation
• Two-factor authentication not being available, or 2FA not being compulsory
• Self-XSS, or XSS that can be triggered only by the attacker in the attacker's own session
• CSRF on login, logout, language and other forms without sensitive actions
• Open redirects that do not reveal a token or credential
• Disclosure of a software version, server banner, stack trace or path where no sensitive data is exposed
• SPF, DKIM or DMARC configuration reports
• Findings from automated scanners not supported by a proof of concept
• Denial of service, exhausting resources, brute force, or any test that creates load
• Social engineering or phishing that targets our staff or our customers; physical attacks
• Issues that belong to third parties we use, including payment processors, Telegram, Cloudflare and email providers
• Library versions that are out of date, without a working exploit against our deployment
• Attacks that cannot work without a compromised device, a rooted phone or a man-in-the-middle position
• Recommendations about best practice, theoretical risks, and duplicates of issues already on record

Policy last updated 2026-10-10.

Rules of engagement

1. First valid report wins. A report that duplicates another, or covers a known issue, is not paid. Every root cause receives one payment, however many endpoints it may affect.
2. Prove it, then stop. Access only your own accounts and data. Where a test would expose data belonging to someone else, stop at the first proof and report it, and do not pivot, download or persist.
3. Do not degrade the service. We do not allow load testing, automated fuzzing at volume, or tests against proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
4. Give us time. We ask that you not publish until the issue is fixed and 30 days have passed. You will be told by us when a fix is live.
5. Severity is ours to set. We assess the impact on our own systems, guided by the Bugcrowd Vulnerability Rating Taxonomy as the reference. Payment amounts sit within the ranges above at our discretion, and we pay them by PayPal or USDT.