Security disclosure

In-scope: everything under hacking.community and its API (/api/*) — including authentication, session handling, payments, marketplace, file uploads, and the E2E chat protocol implementation. Each hosted bug-bounty program may extend scope to its own assets — that scope is documented on the program detail page.

Out-of-scope: third-party services we depend on (Stripe, Google OAuth, Resend, Cloudflare, Upstash). Report those to the vendor first; loop us in if your finding affects hacking.community users.

1. Create a hunter account (free) and submit at /bounties — your submission is tracked, scored, and tied to your profile.
2. If you can't create an account (rare), email legal@hacking.community with the subject [security] and a clear PoC.
3. For sensitive material, request our PGP key by emailing the address above with subject [pgp-please]. We rotate keys yearly.

Programs funded by a verified company use that program's reward table. Findings on hacking.community itself follow this baseline:

// chained findings can stack — first-blood + ATO chain commonly hits the top of the range.

• Triage acknowledged: 24 hours · Sev1/Sev2 inside 4h
• Validation outcome: 5 business days
• Payout decision: 10 business days after validation
• Public disclosure: 90 days (negotiable per-program)

// targets, not contracts. We'll communicate proactively if a finding needs longer.

We will not pursue legal action against good-faith security research that:

• Stays within scope (above), avoids accessing other users' data, and stops at proof-of-concept.
• Does not exfiltrate, exploit, or publish data — and notifies us promptly.
• Avoids degrading service (no automated scanners exceeding 10 req/s).
• Complies with all applicable laws and these Terms.

Bypassing scope, abusing prod, or attempting to extort us voids safe harbour and may itself be unlawful.

Need to ship sensitive material (creds, exploit chains)? Email legal@hacking.community with subject [pgp-please] and we'll reply within 24h with the active public key + fingerprint. Once authenticated on-platform, our E2E direct messages (/chat) are also acceptable — those use ECDH-P256 + AES-GCM, your keys never leave your device.

Hunters who land a resolved finding are added to the public hall of fame — the full leaderboard with payouts and tier badges lives at /bounties/hall-of-fame. Top 10 right now:

// don't see your handle? Submit a finding — we add hunters when the report transitions to resolved.

Security questions, scope clarification, PGP key request: legal@hacking.community.

This policy is the human-readable equivalent of our RFC 9116 file at /.well-known/security.txt.