Responsible Disclosure.

01Our promise

What you can count on if you report a vulnerability.

02In scope · out of scope

What this programme covers, and what it doesn't.

03Rules of engagement

Stay inside these and you are protected.

1. Test only your own data. Create your own accounts. Do not access, modify or destroy data that does not belong to you.
2. No automated scanning at scale. Targeted, manual testing is welcomed; large-scale scans against production are not.
3. Do not exfiltrate. Once you have proof of impact, stop. Don't pivot to other customer data or to internal systems beyond what's needed to demonstrate the issue.
4. Do not pivot or escalate. Treat the first sign of impact as the boundary. Don't chain unrelated issues to widen access.
5. Report promptly. Send what you have within 7 days. Don't sit on findings while you look for more.
6. Give us time to fix. Default coordinated disclosure window is 90 days from triage; we will agree an extension on request for complex issues.
7. No public disclosure until we have shipped a fix or the disclosure window has expired and we have not engaged in good faith.
8. No extortion. Demands for payment in exchange for non-disclosure void this policy and are reported to the relevant authorities.

04Safe harbour

Our legal commitment to good-faith researchers.

This safe-harbour does not extend to testing against systems or data that do not belong to us, nor does it override applicable law. It cannot bind third parties.

05How to report

Send it to one place. Encrypt if you can.

Email hello@whats.exposed with the subject line Security Report. Please include:

• A clear description of the issue and impact, in plain English.
• Affected URLs, endpoints or app builds.
• Step-by-step reproduction, request / response, payloads, screenshots or short video.
• Timestamps of any test traffic so our blue team can correlate.
• Your name and how you would like to be credited (or "anonymous").

For sensitive reports we strongly prefer encrypted email. Our PGP key is below. TODO: paste real public key

We also publish a /.well-known/security.txt at https://whats.exposed/.well-known/security.txt in line with RFC 9116.

06What to expect, SLA

Our service levels for handling your report.

07Severity & triage

How we score what you send us.

We use CVSS v3.1 as our base scoring framework, adjusted for the realistic exploitability and the business impact in our environment. Examples (non-exhaustive):

Critical

Unauthenticated remote code execution, mass account takeover, customer data exposure across tenants, signing-key disclosure.

High

Authenticated privilege escalation across tenants, IDOR exposing customer findings, persistent XSS in the platform UI, SQLi.

Medium

Single-tenant authenticated IDOR, stored low-impact XSS, SSRF without sensitive data exposure, broken session handling without takeover.

Low

Information disclosure of low-sensitivity data, missing security headers with demonstrable impact, rate-limit gaps with feasible abuse.

Informational

Best-practice deviations without an exploit, theoretical issues, scanner output without proof of impact.

08Recognition

What we offer to thank you.

• Public credit on this page (Hall of Fame), with your handle of choice.
• A signed thank-you note from our Head of Offensive Security.
• whats.exposed swag for valid Medium+ findings.
• A direct introduction to our hiring team if you are open to talking, we hire senior offensive specialists.

We do not currently run a paid bug bounty. If you require monetary compensation, please tell us up front so we can discuss whether a private engagement is appropriate.

09Hall of fame

Researchers who have helped us improve.

Listed in chronological order. Most recent at the top. Names appear with permission only, anonymous reporters are credited as "Anonymous".

10Contact

One inbox for everything security-related.