TinyX · Research

Responsible disclosure

Help us keep TinyX secure.

Find something real, tell us first, and we’ll fix it fast, keep you safe, and credit you properly.

Report on HackerOne Read the policy

HackerOne VDP · support@tinyx.co · First response within 1 business day · No legal threats

Hall of fame

Researcher leaderboard

Public credit for people who reported issues in good faith. Summaries are kept deliberately vague until and after fixes ship.

  1. #1 · Gold

    Anonymous

    Client-side encryption design issue

    60 pts

  2. #2 · Silver

    Muhammad Huzefa

    github.com/Huzefa1122

    Quota and account-abuse controls

    55 pts

  3. #3 · Bronze

    Asfahan

    Plan-limit enforcement race conditions

    50 pts

  4. #4

    Shahd Ashraf

    Plan-limit enforcement issue

    40 pts

How points work

Points reflect the highest-severity confirmed finding, plus a small bonus for additional distinct valid findings. Volume never outranks severity.

  • Critical 100 · High 75 · Medium–High 60 · Medium 40 · Low 15 · Informational 5
  • +5 per additional distinct valid finding, capped at +15
  • Ties: earliest report first

Plain-text list: /thanks.txt. Prefer to stay anonymous? Say so when you report and we’ll honour it.

Scopetinyx.co app & APIAuth, encryption, data exposure, access controls. RecognitionDiscretionary rewardsLifetime Pro/Max plans at our discretion, as a personal single-use code. Response1 business day ack · 3 business days triageDirect contact with the people who fix the code.

Scope

High-level summary. The authoritative list lives on tinyx.co/security.

In scope

  • Auth / authorisation bypasses
  • XSS, injection, SSRF
  • Encryption implementation flaws
  • Data exposure or leakage
  • Privilege escalation across tiers or roles
  • Webhook / API abuse, session issues
  • Bypasses of link expiry, download limits, or access controls

Out of scope

  • Social engineering or phishing our team
  • DoS / DDoS testing on production
  • Issues in third-party services (report to them)
  • Missing headers without a demonstrable exploit
  • Self-XSS or physical-access requirements
  • Scanner output without a verified exploit

Full scope, testing rules, and stack details: https://tinyx.co/security

How to report

Submit your report through our HackerOne vulnerability disclosure program, or use the embedded form on tinyx.co/security. Can’t use HackerOne? Email support@tinyx.co.

  1. Describe itA clear description of the vulnerability.
  2. Show usSteps to reproduce (more detail means faster triage).
  3. Explain impactPotential impact as you understand it.
  4. Stay reachableYour contact information so we can follow up.
Submit a report on HackerOneEmail support@tinyx.co

Policy

This is a vulnerability disclosure program run on HackerOne. There are no fixed payouts. We still welcome good-faith reports and treat them with urgency, respect, and credit when you want it.

What we promise

Straight talk from the people who ship the code.

First response within 1 business day
We confirm receipt and assign someone to your report.
Triage within 3 business days
We assess severity, confirm the issue, and share a timeline.
Credit (unless anonymous)
We publicly thank researchers who want recognition — see the leaderboard.
Direct human communication
No support bots. Reports go straight to the people who fix the code.
Rules of engagement
  • Use your own test accounts only — never other users’ data
  • Do not disrupt the service (no production load tests, no deleting others’ files)
  • Coordinated disclosure: give us reasonable time to patch before going public
  • One vulnerability per report
Safe harbour

No legal threats. Follow this policy and we will not pursue legal action against you.

HackerOne’s Gold Standard Safe Harbor also applies to research under this policy.

Rewards

There is no fixed bounty table. When we reward a finding, it is with a lifetime Pro/Max plan at our discretion, delivered as a personal single-use code, depending on severity and impact.

What we can guarantee: if you find something real and report it responsibly, we will not ignore you.

FAQ

Is there a fixed bounty?

No. Rewards are at our discretion and depend on severity and impact. See Rewards above.

Can I stay anonymous?

Yes. Say so when you report — we will honour that.

Where is the full policy?

tinyx.co/security is authoritative; this page summarises it.

Why are leaderboard summaries vague?

To protect users, we describe findings only at a high level. No endpoints, payloads, or reproduction details are published.