Bug bounty: report a hole, get credit

Found a hole in one of our services? Tell us first and we will thank you in public.

In scope

• Forging, replaying or altering a stamp, receipt or record so that it still verifies.
• Making a check pass work that should fail.
• Reading data that is not yours, or finding a secret.
• Getting around a published limit or cap.
• Anything that would make our stamp mean less than we say.

Rules

• Test with your own data and your own keys only.
• No denial of service, no flooding, no spam, no social engineering of anyone.
• Use live services only as a normal caller would; send hostile input to your own copies, or ask us first.
• Stop and tell us as soon as you see data that is not yours; do not keep it.
• Give us 90 days to fix before you publish, or less if we agree.

Out of scope

• Services run by others (Cloudflare, directories, payment providers) and their accounts.
• Denial of service, spam, social engineering, physical access.

If you make a good-faith effort to follow these rules, we consider your research authorised, we will not pursue legal action against you for it, and if someone else does, we will say you acted with our permission.

Rewards

Thanks and public credit on the security page now. Cash rewards are not paid yet; when they start, the amounts will be posted here first. Nothing on this page is an offer of payment.

How to report

Email [email protected] with the service, the time (UTC), the steps, and what you saw. See also security.txt.

Page dated 12 November 2026. Written by our Legal and Attack Team seats; not yet reviewed by a licensed attorney.