Tell us. We'll fix it.

We run a private disclosure program for security researchers. Reports that reproduce against production services are eligible for credit and bounty.

Scope

• + Cross-tenant data exposure in the lab orchestrator
• + Authentication bypass in Pwnbox provisioning
• + Privilege escalation from operator tier to admin
• + Flag validator integrity issues
• + SSRF or RCE against edge.snailsec.io or api.snailsec.io

Out of scope

• − Designated lab targets themselves — they are intentionally vulnerable
• − Denial of service against any service
• − Physical, social engineering, or third-party infrastructure
• − Self-XSS requiring user to paste content into devtools

Commitments

• > Acknowledge within 24 hours
• > Triage within 72 hours
• > Critical issues fixed within 7 days, with credit to the reporter in our public hall of fame
• > No legal action against good-faith researchers operating within scope

> full policy: /.well-known/security.txt

Hall of fame

Researchers who reported security issues in good faith. Thank you.