Security

Bug bounty & responsible disclosure

Found a security issue in VC Boom? Tell us. This program is fully self-managed: submit below or talk to Anora, our on-site assistant, and we take it from there. Every valid report earns Hall of Fame recognition and leaderboard points. We do not offer cash rewards at the moment. No account needed, no red tape.

How we recognise reports

Critical100 pointsRCE, auth bypass, mass PII access, payment manipulation

High50 pointsAccount takeover, IDOR exposing another user's data, stored XSS

Medium20 pointsReflected XSS, CSRF on a sensitive action, privilege issues

Low8 pointsSelf-XSS, low-impact info disclosure, rate-limit gaps

Informational2 pointsMissing headers, version disclosure, best-practice notes

Severity is set by us after triage using real-world impact, not the scanner label. Every valid reporter earns leaderboard points and a Hall of Fame spot. Solve more, climb the board. We do not offer cash rewards at the moment; if that changes, we will say so on this page first.

Report a vulnerability

In scope

www.vcboom.com and the authenticated app (/app/*)
The VC Boom API (/api/*) that powers scoring, matching, and outreach
Authentication, authorization, and payment flows
Anything that exposes another user's data or our investor dataset at scale

Out of scope

Missing security headers with no demonstrated impact (we already harden these)
Automated scanner output with no working proof of concept
Denial of service, volumetric, or brute-force attacks
Social engineering, phishing, or physical attacks
Issues in third-party services we use (Clerk, Stripe, Resend, Vercel, Supabase). Report those to them
Self-XSS, clickjacking on pages with no sensitive action, or theoretical issues with no real-world impact

Rules & safe harbor

Only test against your own account and data. Never access, modify, or exfiltrate another person's data.
No denial of service, automated high-volume scanning, or anything that degrades the service for real users.
Report promptly and keep the issue confidential until we have shipped a fix.
One issue per report. First valid reporter of a unique issue gets the points; duplicates are acknowledged but not credited twice.
Acting in good faith and within these rules, we will not pursue or support legal action against you (safe harbor).

Hall of Fame

Be the first. Researchers who report a valid issue are credited here by their chosen handle, ranked by points.

Prefer email? Send your report to security@vcboom.com. Machine-readable policy at /.well-known/security.txt.