Responsible disclosure & bug bounty policy

Scope

What we pay

You are rewarded for impact on our systems or customers that you have demonstrated. Amounts are in USD.

Rules of engagement

1. First valid report wins. A duplicate, or a report of an issue we already know about, is not paid. You are paid once for each root cause, whatever number of endpoints it affects.
2. Prove it, then stop. Access only your own accounts and data. If a test would expose another person's data, end it at the first proof and report, without pivoting, downloading or persisting.
3. Do not degrade the service. Load testing, automated fuzzing in volume, and testing proxy gateways, modem hosts or carrier networks are not permitted. Those are out of scope entirely.
4. Give us time. Do not go public until the issue is fixed and 30 days have run. When a fix goes live, we let you know.
5. Severity is ours to set. The Bugcrowd Vulnerability Rating Taxonomy is our reference when we rate impact on our own systems. The amount paid is at our discretion within the ranges above, and payment is by PayPal or USDT.

What we do not pay for

These count as Low or Informational at the very most. They will be read and anything worth fixing will be fixed, but no bounty is issued, and a Critical or High label on the report has no effect on that.

• Old sessions that keep running after a logout, password change or password reset until the session token times out
• A missing or “weak” security header (CSP, HSTS, X-Frame-Options, Referrer-Policy) reported without a working exploit
• Clickjacking where the page has no sensitive action to trigger
• Cookie attributes, where the cookie is not a session cookie
• Email or username enumeration, also when done through timing or error messages
• Forgot-password, login or rate-limit observations if no account takeover has been demonstrated
• Password policy opinions about length, complexity, common-password lists, or not forcing rotation
• Accounts without two-factor authentication, or with 2FA optional
• Self-XSS, or XSS that works only when attackers run it in their own session
• CSRF on the login, logout or language form, or another non-sensitive one
• Open redirects unless they leak a token or credential
• Disclosed software versions, server banners, stack traces or paths when no sensitive data is included
• SPF, DKIM or DMARC configuration reports
• Automated scanner findings unless a proof of concept comes with them
• Load-generating tests of any kind, including denial of service, resource exhaustion and brute force
• Social engineering or phishing directed at our staff or customers, as well as physical attacks
• Issues found in outside services we use, for example payment processors, Telegram, Cloudflare and email providers
• Out-of-date library versions where no working exploit against our deployment exists
• Any attack that only works with a man-in-the-middle position, a compromised device or a rooted phone
• Best-practice notes, risks that exist only in theory, and duplicates of known issues

Policy last updated 2026-10-10.