Security
Bug bounty
Found a security problem in our website, API or app? Tell us privately. We fix valid reports quickly, keep you informed, and reward you according to the impact.
Rewards
| Level | Reward | For example |
|---|---|---|
| Critical | up to $1,000 | Taking over accounts, reading other customers' data, running code on our servers |
| High | up to $400 | Bypassing payment or plan limits, stealing API keys, stored XSS on our pages |
| Medium | up to $150 | CSRF on an important action, reflected XSS, access to data that should be private |
| Low | Hall of fame | Minor issues with a real security impact |
The level is decided by our team from the real impact. The first valid report of a problem gets the reward; duplicates are credited, not paid. Rewards are paid to your account balance, or in USDT on request.
Scope
In scope: this website and its subdomains, the API, the iPhone and Android app, the partner API.
Out of scope: denial of service and load tests, spam or social engineering, physical attacks, reports from automated scanners without a working proof, missing headers without a real impact, issues in other companies' services.
Rules
- Test only with your own accounts and data; never access, change or delete other people's data.
- No denial of service, load tests, spam, phishing or physical attacks.
- Stop and report as soon as you find a problem; do not use it further.
- Keep it private until we have fixed it (we tell you when). We do not take legal action against good-faith research that follows these rules.