Responsible disclosure & bug bounty policy

Scope

What we pay

What we reward is demonstrated impact on our systems or on our customers. Amounts are in USD.

What we do not pay for

These are accepted at Low or Informational, never higher. Each one is read and anything worth fixing gets fixed, but no bounty is issued, even if the report carries a Critical or High label.

• A login session that survives a password reset, a password change or a logout until its token expires
• Absent or “weak” security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) lacking a working exploit
• Clickjacking of pages that have no sensitive action
• Attribute settings on cookies that are not session cookies
• Username or email enumeration, timing- and error-message-based included
• Login, forgot-password or rate-limit findings that stop short of a demonstrated account takeover
• Views about password policy: complexity, length, no forced rotation, common-password lists
• 2FA that is optional, or no two-factor authentication offered
• XSS that only fires in the attacker's own session, or Self-XSS
• CSRF on non-sensitive forms such as login, logout or language
• Open redirects with no token or credential leakage
• Server banners, software versions, stack traces or paths disclosed without sensitive data
• SPF, DKIM or DMARC configuration reports
• Results from automated scanners that come without a proof of concept
• Brute force, denial of service, resource exhaustion or any test that creates load
• Social engineering or phishing against our customers or staff, and physical attacks
• Issues found in the third parties we work with: payment processors, Telegram, Cloudflare, email providers
• Outdated libraries, unless there is a working exploit against our deployment
• Anything that only works from a compromised device, a rooted phone or a man-in-the-middle position
• Best-practice suggestions, theoretical risks, and repeats of issues we already know

Policy last updated 2026-10-10.

Rules of engagement

1. First valid report wins. Duplicate reports, and reports on issues already known to us, are not paid. A single root cause earns one payment, whatever the endpoint count.
2. Prove it, then stop. Access only your own accounts and data. When a test would reveal someone else's data, stop at your first proof and report — never pivot, download or persist.
3. Do not degrade the service. Do not run load tests, automated fuzzing at volume, or any test against proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
4. Give us time. Please wait to publish until we have fixed the issue and 30 days have passed. We will let you know when a fix goes live.
5. Severity is ours to set. Using the Bugcrowd Vulnerability Rating Taxonomy as the reference, we rate the impact on our own systems. Within the ranges above, payment amounts are at our discretion, paid by PayPal or USDT.