Security
Responsible disclosure.
Find a vulnerability? Tell us before you tell the world. We’ll respond within 48 hours, patch within 30 days for anything Critical/High, and credit you in the hall of fame. Cash bounties unlock at GA.
How to report
- Email [email protected]. PGP key on request.
- Include a clear reproducer: HTTP requests, payload, expected vs actual behavior. Screenshots help, but a minimal curl is the fastest path to triage.
- Don’t test against accounts you don’t own. Spin up two dev accounts and use them.
- Don’t pull customer data. If you stumble onto data you couldn’t avoid (an IDOR returns someone else’s record), stop, take a screenshot, report it, don’t exfil.
- Give us 30 days to fix before any public write-up. We’ll credit you in the next changelog entry and the hall of fame below if you want.
In scope
- nyhilism.com (marketing + dashboard)
- *.nyhilism.com
- tag.js (the public embed)
- /api/serve, /api/imp, /api/click (the ad-server hot path)
- /api/openapi.json + /sellers.json + /blocklist.txt
Out of scope
- Third-party services we contract with (Cloudflare, R2, Hetzner) — report directly to them.
- Rate-limiting bypass without an additional vulnerability.
- Social engineering of staff or contractors.
- Physical attacks against any Nyhilism property or person.
- DOS via traffic flooding (we'd rather you not).
- Self-XSS or vulnerabilities that require a compromised device.
Payouts
Ranges are guidelines, not contracts. Severity is our call, informed by impact, exploit difficulty, and quality of the report. Disputes go to [email protected].
Cash bounties are paused during alpha.
The tier structure below is what we’ll launch with at GA. For now, every confirmed report — regardless of severity — gets hall-of-fame credit and a written thank-you. We’d still rather hear about a Critical from you than from Twitter.
| Tier | Payout | Examples |
|---|---|---|
| Critical | $5,000 – $25,000At GA | RCE on production, full account takeover via no user interaction, customer-data exfiltration. |
| High | $1,500 – $5,000At GA | Stored XSS in the dashboard, auction-tampering, signed-token forgery, persistent privilege escalation. |
| Medium | $500 – $1,500At GA | IDOR exposing data of other orgs, CSRF on a sensitive action, viewability-bypass that materially affects billing. |
| Low | $100 – $500At GA | Reflected XSS, info disclosure (non-customer), CSP weakness with a real attack chain. |
| Acknowledgement | Hall of fame | Issues we already knew about, near-duplicates, or best-practice fixes without a concrete attack chain. |
Hall of fame
Empty for now.
Be the first.
For non-security disclosures, see DMCA (copyright) and 2257 statement (performer records).