People who made CipherProof safer.
You test other people’s systems for a living. If you find a problem in ours and tell us first, we will say thank you in public.
Status: open
CipherProof is live, and reports are welcome now. The wall is empty until the first accepted report. The rules below may be adjusted as the service grows.
The wall
No entries yet. The first name on this wall could be yours.
Each entry shows your name or handle, a link if you want one, what kind of problem it was, its severity and the month we fixed it.How a report goes
- You send it privately.Email [email protected] with what you saw and the steps to reproduce it. Please do not post it before we have answered.
- We confirm.We reply, tell you whether we can reproduce it, and give you a rough time for the fix.
- We fix it, then credit you.With your agreement we add your name to the wall. You can stay anonymous.
Rewards
- A reward may be paid.For serious findings we may pay. The amount depends on the severity and on how well the report is written, and we decide it after review.
- Nothing is promised in advance.There is no fixed price list yet, and a valid report does not always earn money. Credit on the wall is always free.
What is in scope
- The CipherProof app and its API.Accounts, projects, uploads, report export and the sign-in flow.
- This website.Problems that affect visitors.
- Reports that show an effect.Raw scanner output without proof, and missing headers with no demonstrated impact, are not counted.
Ground rules
- Use your own account and data.Do not open, change or delete anyone else’s data. Stop as soon as you have shown the problem.
- No disruption.No denial of service, spam, social engineering or physical attacks.
- Good-faith research is welcome.If you follow these rules, we treat your testing as authorised and will not take legal action against you.
Found something?
Tell us what you saw and how to reproduce it.
[email protected]