We build security products, so we hold our own work to the same standard we ask of
everyone else. If you've found a vulnerability in anything we run, we want to hear
about it — and we'll treat you well for telling us.
Safe harbour
If you make a good-faith effort to follow this policy, we will treat your research as
authorised. We will not pursue legal action against you, and we will not report you to
law enforcement. If a third party brings action against you for research conducted
within this policy, we will make it known that your testing was authorised.
Good faith means: you stayed inside the scope below, you didn't access, modify, or
keep data that wasn't yours, you stopped as soon as you'd confirmed the issue, and you
gave us a reasonable chance to fix it before telling anyone else.
In scope
- redeyed.com and its subdomains
- The Redeyed API (api endpoints under /api/v1)
- Redeyed Sentinel — the captcha widget, verification API and CMS plugins
- The Redeyed desktop client (Windows)
- Authentication, billing, and members' panel functionality
Out of scope
- Denial of service, load testing, or anything that degrades service for others
- Social engineering of staff, users, or support — including phishing
- Physical attacks, or access to infrastructure you don't own
- Automated scanner output with no demonstrated impact
- Missing security headers, cookie flags, or TLS configuration without a working exploit
- Self-XSS, or issues requiring a rooted/jailbroken device or a malicious browser extension
- Rate-limit findings on unauthenticated, non-destructive endpoints
- Email spoofing / SPF-DMARC reports without a demonstrated impact
- Reports about third-party services we don't control
- Outdated-software banners without a proven exploitable path
Rules of engagement
- Test only your own accounts. Create as many as you need — don't touch anyone else's.
- Don't exfiltrate data. If you can read a record that isn't yours, that proves the issue. Stop there, and tell us what you saw without keeping a copy.
- Don't degrade the service. No denial of service, no load or stress testing, no brute forcing at volume.
- Leave people alone. No social engineering of our staff, our users, or our support channel.
- Give us time. Please don't publish, or share the details, until we've shipped a fix or agreed a date with you.
- Automated scanners are fine — but raw scanner output isn't a report. Show us the impact.
What happens after you report
- Acknowledged within 2 business days
- Triaged within 7 business days
- Critical fixed in 7 days
- High in 30 days
- Everything else in 90 days
You'll get a reference number immediately. We'll keep you updated as we triage, and
we'll tell you when it's fixed. If we disagree with your severity assessment, we'll
explain why rather than just closing it.
Recognition
We don't run a paid bounty yet, and we'd rather say that plainly than advertise a
reward we're not ready to honour. What we do offer: a fast, human response, public
credit on this page if you want it, and account credit on any Redeyed product at
our discretion. If you find something genuinely serious, talk to us — we'll do
right by you.
Report a vulnerability
Use the form below, or email
[email protected] directly. Our machine-readable
policy lives at /.well-known/security.txt.
