Security Policy

Reporting a vulnerability

If you discover a security vulnerability in BanProof, please report it to us at security@banproof.io. Include a description of the issue, steps to reproduce, and potential impact.

We will acknowledge your report within 3 business days and aim to resolve confirmed issues within 30 days.

Responsible disclosure

We ask that you:

• Give us reasonable time to investigate and fix the issue before public disclosure
• Avoid accessing, modifying, or deleting user data beyond what is needed to demonstrate the vulnerability
• Do not perform denial-of-service attacks or spam
• Do not social-engineer our team or users

Scope

• banproof.io and all subdomains
• BanProof web application and API

Out of scope: third-party services we depend on (Supabase, Stripe, AWS).

Recognition

We don't currently offer a paid bug bounty program. We do offer public acknowledgement (with your permission) for valid, responsibly disclosed reports.