bug bounty

Hack the system

We believe security is a community effort. moood invites researchers to responsibly disclose vulnerabilities in exchange for recognition and financial rewards that grow as we grow.

Overview

Responsible disclosure at moood

This program is not yet open. moood is currently in alpha testing. We are not accepting security reports, crediting findings, or acknowledging any testing conducted prior to the official launch of this program. any unauthorized testing of our systems before the program is live is not appreciated and will not be recognized. the information below outlines what the program will look like when it launches. please check back when we announce the program is live.

We're a startup. we can't compete with big tech bounties yet but we promise transparency, respect and retroactive rewards for those who help us early.

rules of engagement

How to test responsibly

Don't access other users' data. Use your own test accounts. if you accidentally access another user's data, stop immediately and report it.

No destructive testing. Don't degrade service availability or corrupt data. describe destructive PoCs theoretically.

Report promptly. Submit findings as soon as you have a reproducible proof of concept. don't sit on vulnerabilities.

90-day disclosure window. Give us 90 days to fix the issue before public disclosure. we'll keep you updated on progress.

One report per root cause. Multiple instances of the same vulnerability = one report. duplicates of known issues won't qualify.

Clear reproduction steps. Include the full URL, parameters, payloads, screenshots, and tools used. easier to reproduce = faster to fix.

safe-harbor.txt

# safe harbor policy

we consider security research conducted in accordance
with this policy to be:

  → authorized
  → lawful
  → helpful
  → protected

we will not pursue civil or criminal action against
researchers who discover and report vulnerabilities
in good faith and in compliance with this policy.

if you are uncertain whether your research is
consistent with this policy, reach out first.
we're happy to clarify.

Hack the system

Responsible disclosure at moood

Rewards that scale with us

What's in bounds

In scope

Out of scope

How to test responsibly

Researchers who made moood safer

How to reach us

Settings

Delete your moood account?

Final confirmation

Login to your account

Enter your code

Two-factor code

Hack the system

Responsible disclosure at moood

Rewards that scale with us

What's in bounds

In scope

Out of scope

How to test responsibly

Researchers who made moood safer

How to reach us