Up to €5,000 for a real security flaw
We sell privacy. That only works if our systems hold up. A flaw you find and report to us is worth far more than one someone else finds quietly — so we pay for it.
Rewards
We classify by real-world impact, not by scanner score. The final rating is ours, made in good faith after review.
- Breaking end-to-end encryption
- Reading other users' messages
- Remote code execution on our servers
- Taking over arbitrary customer accounts
- Access to decrypted customer data (orders, addresses)
- Bypassing authentication
- Privilege escalation to admin
- Redeeming activation codes of others
- Stored XSS with real impact
- IDOR with limited scope
- Bypassing rate limits with demonstrable harm
- Smaller issues with proven but limited impact
The first report of an issue counts. Payout follows verification and fix, by bank transfer or cryptocurrency — your choice. If you prefer, we can also donate your reward to a privacy organisation.
In scope
- saferphone.to — shop and website
- matrix.saferphone.to — Matrix server, push, /spm/api
- The VOID app (current version)
Out of scope
- DoS/DDoS, load and volume testing
- Social engineering or phishing against staff or customers
- Physical attacks, device theft
- Missing best practices without demonstrable impact (headers, SPF/DMARC, TLS tuning)
- Self-XSS, clickjacking without a security-relevant action
- Raw scanner output without proof of exploitability
- Flaws in third-party services (hosting, Cloudflare, GrapheneOS, Synapse itself) — please report those upstream
- Already known or duplicate reports
Rules
- 1Use your own test accounts only.
- 2Never read, change or delete other people's data. If you access something by accident: stop immediately, keep no copies, and tell us.
- 3No service disruption, no spam, no data destruction.
- 4Do not publish before the issue is fixed — we coordinate disclosure with you.
- 5One issue per report, with steps we can follow.
Safe Harbor: If you follow these rules, you have nothing to fear from us. We consider such research authorised and will not pursue legal action against you.
What happens next
Within 72 hours
We confirm receipt of your report.
Within 7 days
You get a first assessment and our severity rating.
After the fix
We verify, fix, and pay out — and credit you if you want.
Report a vulnerability
Describe the issue as precisely as you can — the easier we can reproduce it, the faster it gets fixed and paid.
Highly sensitive details? Send them through our Secure Message — end-to-end encrypted, readable once — and just reference the link here.
This programme is a voluntary offer. There is no legal entitlement to a reward; we decide on classification and payout after reviewing each case. Employees and people involved in building these systems are excluded.