Bug bounty
We welcome reports from security researchers. If you find a vulnerability in Betteria, email it to us privately and our technical team will review it.
Reports go to [email protected]
How to report
One email per issue, written so we can reproduce it without guessing.
Send it to
After you send a report, our technical team reviews it and replies to you.
Write in English or Persian.
Rewards
Valid findings with real impact are considered for a reward. Whether a report is rewarded, and what the reward is, the team decides case by case once the review is done. There is no price list.
What to include
- The affected URL or endpointThe full address, and the request method for an API route.
- Steps to reproduceNumbered, from a signed-out browser or a named account, to the moment the problem shows.
- The impactWhat an attacker gains: whose data, which action, and what it takes to get there.
- A proof of conceptA request, a script or a short recording that shows it working. Redact anything that is not yours.
- The accounts you usedThe email addresses of your test accounts, so we can tell your traffic apart from everyone else's.
Scope
What we want you to look at, and the findings we close without a reward.
In scope
Issues on these surfaces, with a security impact you can demonstrate.
- betteria.app and its APIThe site, and every route under /api/.
- AuthenticationGoogle sign-in, email and password, two-factor, email verification, password reset and sessions.
- Access between accountsReading or changing another person's measurements, goals, circles, crews, families, messages or profile: IDOR and broken row-level security.
- BillingCheckout, subscription state, Stripe webhook handling, and the features a plan unlocks.
- Share linksA /r/ result link that exposes the answers behind a card.
- Injection and exposureStored or reflected XSS, SQL injection, SSRF, remote code execution, and secrets exposed in client code.
Out of scope
Reported on their own, these are closed without a reward. If one is a step in a chain that reaches something in scope, report the chain.
- Self-XSS, or anything that needs the victim to paste code into their own browser
- Clickjacking on pages with no sensitive action
- CSRF on sign-out, or on any other action that changes no state
- Missing security headers or cookie flags without a demonstrated exploit
- SPF, DKIM, DMARC, CAA or DNSSEC findings
- Software versions or server banners being visible
- Missing rate limits on endpoints other than authentication
- Denial of service, volumetric attacks and load testing
- Automated scanner output without a working proof
- Social engineering, phishing and physical attacks
- Vulnerabilities in Cloudflare, Google or Stripe themselves
- Open redirects without demonstrated impact
- Content spoofing and text injection
- Tabnabbing
- CSV or formula injection
- Account or email enumeration with no further impact
- Best-practice suggestions, such as password policy or HSTS preload
- Anything that needs a rooted or jailbroken device, an outdated browser, or physical access to an unlocked device
- Issues we already know about, and duplicates of an earlier report
Rules of engagement
Research that follows these rules is research we want.
Use your own accounts
Test only with accounts you created. Two of your own are enough to show any problem between accounts.
Take only what proves it
Access no more data than it takes to demonstrate the issue, and never another person's real data. If you reach it by accident, stop and tell us.
No high-volume scanning
The site sits behind a web application firewall that blocks automated traffic, so a scanner locks you out long before it finds anything.
No live payments
Do not complete a real purchase to test billing. Use your own test account, and ask us if there is a payment state you cannot reach.
Keep it private until it is fixed
Do not publish or share the details of an issue before we have fixed it.
Safe harbour
If you research in good faith and within these rules, we will not pursue legal action against you for it. If a rule is unclear, ask us before you test.