> Responsible Disclosure
Report a vulnerability to [email protected] · policy also published at /.well-known/security.txt
Safe harbour
If you act in good faith, stay within the scope below, only use accounts and data you own, stop as soon as you have demonstrated impact, and give us reasonable time to fix the issue before going public, we will not pursue legal action and will treat your report as authorised research.
How to report
Email [email protected] with: • A clear title and severity you'd assign • Affected URL / endpoint / parameter • Step-by-step reproduction (curl, script or screenshots) • Impact: what an attacker gets • Your handle if you want credit Please do not open a public issue, post on social media, or contact support chat for security reports.
Incident timeline
- T+0
Report received
You email [email protected] with the details below.
- T+72h
Acknowledgement
We confirm receipt and assign a tracking reference.
- T+7d
Triage complete
Reproduced or rejected, severity assigned (Critical / High / Medium / Low), remediation plan shared.
- T+30d
Critical fixed
Critical issues patched and verified. High: 60 days. Medium/Low: next release cycle.
- T+72h after confirmation
User notification
If personal data was exposed, affected users are notified with scope and next steps.
- T+90d
Public disclosure
Coordinated disclosure allowed after a fix ships, or 90 days after the report — whichever comes first.
In scope
- • The main web application and all its brand domains
- • Public API and server-side functions (payments, webhooks, chat proxy)
- • Authentication, session handling and token/balance logic
- • Access control flaws (RLS bypass, IDOR, privilege escalation)
- • Stored/reflected XSS, CSRF, SSRF, injection, RCE
- • Payment logic abuse (free credits, replayed or forged webhooks)
Out of scope
- • Denial of service, volumetric or stress testing
- • Social engineering, phishing or physical attacks against the operator or users
- • Automated scanner output with no demonstrated impact
- • Missing hardening headers or best-practice notes without an exploit path
- • Vulnerabilities in third-party providers — report those to the provider
- • Content moderation complaints or model output concerns (not security issues)
Recognition
We do not run a paid bug bounty. Valid reports are rewarded with account credits scaled to severity and, if you want it, public credit on this page. We reserve the right to decide validity and severity.
━━━━━━━━━━━━━━━━━━━━
FraudGPT © 2026