Privacy Policy
Last updated: June 2026
Information We Collect
We collect the following types of information:
- Account data: name, email, username, password hash
- Profile data: bio, skills, country, social links
- Activity data: reports submitted, comments, bounty transactions
- Technical data: IP address (for rate limiting), browser type
How We Use Your Data
- To provide and maintain the platform
- To process vulnerability reports and bounty payments
- To display public profiles and leaderboard rankings
- To send notifications about report status and program updates
- To prevent abuse and enforce our terms of service
Data Security
We implement industry-standard security measures including:
- Passwords hashed with bcrypt (12 rounds)
- JWT tokens stored in HttpOnly, Secure, SameSite cookies
- Two-factor authentication (TOTP) available for all accounts
- Encrypted database connections (SSL/TLS)
- Rate limiting on authentication endpoints
Data Sharing
We do not sell your personal data. Information may be shared:
- With program owners when you submit a report to their program
- Publicly on your profile page (name, username, reputation, skills)
- On the leaderboard (username, reputation, resolved count)
- When required by law or to protect our legal rights
Your Rights
You have the right to:
- Access your personal data through your profile settings
- Update or correct your information at any time
- Request deletion of your account and associated data
- Opt out of non-essential notifications
Cookies
We use essential cookies only for authentication (JWT session token). We do not use tracking cookies, advertising cookies, or third-party analytics.
Contact
For privacy-related inquiries, contact us through the platform or at the email listed on our website.