Security

How to report a problem

Use the contact form and choose “A security problem”, or write to [email protected]. Please report it to us privately rather than in a public issue, post or chat.

What to include

• The page, route or feature affected, with the exact URL.
• The steps to reproduce it, and what an attacker could do with it.
• Any proof of concept, kept to the smallest thing that shows the problem.
• How you would like to be credited, if at all.

What’s in scope

• bnbglobalguild.com and every page and API route under it.
• Sign-in for the team and for ambassadors: X, Telegram and the phone link.
• The donation flow and the public ledger.
• The site’s Telegram bot and its buttons.

What’s out of scope

• Services we use but don’t run: the exchange API, BNB Smart Chain and other chain nodes, X, Telegram, Cloudflare and our hosting provider. Report those to them.
• Other websites that happen to share our hosting.
• Denial of service, load or volume testing, and anything that degrades the site for others.
• Spam, social engineering or phishing of our team or ambassadors, and physical attacks.
• Reports with no demonstrated impact: a missing header on its own, version numbers, self-XSS, clickjacking on pages with no actions, or rate limits on endpoints that change nothing.
• Sending funds to our donation wallets. Those addresses are public on purpose.

Rules for testing

• Test only against accounts and data that are yours.
• Don’t read, change or delete other people’s data. If you reach any, stop and tell us.
• Keep automated scanning slow and light.
• Give us a reasonable time to fix a problem before you talk about it publicly. We ask for 90 days, or less once a fix is live and we’ve agreed.

What we promise

• We read every report, and we’ll confirm we have yours within 5 working days.
• We’ll tell you what we found, what we’re doing about it, and when it is fixed.
• We’ll credit you when the fix is out, if you want to be.
• We won’t take legal action against research that follows this policy in good faith, and we won’t ask anyone else to. If you follow these rules and something is unclear, ask us first and we’ll treat you the same way.

Rewards

Machine-readable

The same contact details are published in /.well-known/security.txt. Back to the explorer