---
title: "Report a Vulnerability"
description: "How to report a security vulnerability to MeinGPT, how our Bug Bounty Program works, and who has already helped"
canonical_url: "https://meingpt.com/en/docs/privacy-security/vulnerability-disclosure"
language: en
---

# Report a Vulnerability

Found a security vulnerability? This page is your central point of contact for all security-related reports.

For a technical overview of our infrastructure and software security, see [meingpt.com/security](https://meingpt.com/en/security) and the [Trust Center](https://meingpt.com/en/trust-center).

## 🚨 How to report it

If you have discovered a **security vulnerability**:

📧 **Email**: security@meingpt.com
📝 **Subject**: `URGENT - Critical Security Issue` (for critical issues)

### What to include

- A **detailed description** of the vulnerability
- **Steps to reproduce** the issue
- **Potential impact** and a risk assessment
- Screenshots or code examples, if possible

We prioritize reports by severity and respond as quickly as possible.

## 💰 Bug Bounty Program

We reward security researchers who responsibly find and report vulnerabilities in our systems.

### Reward amount

The amount is based on:

- **Severity of the vulnerability** (Critical, High, Medium, Low)
- **Quality of the report** (reproducibility, documentation, clarity)
- **Potential impact** on users and systems
- **First report** (only the first valid report is rewarded)

### Scope

#### In Scope

- Web applications and APIs (app.meingpt.com)
- Authentication and authorization
- Data leaks and privacy violations
- SQL injection, XSS, CSRF
- Remote code execution
- Authentication bypass
- Privilege escalation

#### Out of Scope (no reward)

- **Expired SSL/TLS certificates** – we appreciate the report, but it doesn't qualify for a bounty
- **Missing security headers** without demonstrated impact
- **Self-XSS** requiring user interaction
- Social engineering attacks
- DoS/DDoS attacks
- SPF/DMARC/DKIM issues without demonstrated exploitability
- Rate-limiting issues without security impact
- Vulnerabilities in third-party systems (report directly to the vendor)
- Issues in deprecated or end-of-life features
- Theoretical vulnerabilities without a proof of concept
- Paywall/feature-gating bypasses that don't lead to unauthorized data access
- [HackerOne Core Ineligible Findings](https://docs.hackerone.com/en/articles/8494488-core-ineligible-findings)

### Participation

Contact us for the current terms of the Bug Bounty Program: security@meingpt.com

We'll then discuss individually:

- The scope of allowed tests
- Testing methods
- Reporting procedures
- The verification process

### Program rules

1. **Don't access, modify, or delete user data.** Use our staging environment at staging.meingpt.com to make sure you don't accidentally access real user data.
2. **Avoid service disruption** – no DoS attacks or resource exhaustion.
3. **One vulnerability per report** – separate issues need separate reports.
4. **Allow time for patching** – coordinate the disclosure timeline with our team.
5. **Comply with all applicable laws** – unauthorized access is prohibited.
6. **Report in good faith** – no extortion or threats.
7. **Test accounts only** – use accounts you control.

### Disqualifications

The following will result in **immediate disqualification** from the program and may lead to legal action:

- Public disclosure before resolution
- Attempted extortion
- Testing on production systems without authorization
- Accessing customer data
- Social engineering of employees
- Physical attacks on our infrastructure

## Responsible Disclosure Policy

### ✅ Allowed

- Coordinated disclosure after successful resolution
- Recognition in our Hall of Fame
- Legal protection for researchers who report responsibly
- Constructive collaboration with our security team

### ❌ Not allowed

- Accessing customer data without permission
- Denial-of-service attacks
- Social engineering of employees
- Physical attacks on our infrastructure

## 🏆 Hall of Fame

We thank all security researchers who have helped improve MeinGPT. With their consent, we publish their names here.

- [Kunal Mishra](https://x.com/Jaguar_Kunal)
- [Aqudas Gulzar](https://www.linkedin.com/in/aqudas-gulzar/)
- Fabrikat0r
- [Foysal Ahmed Fahim](https://foysalsec.com)
- Prashant
- Sumit Bhadouriya
- Cyber_Subhash
- [Umanhonlen Gabriel](https://www.linkedin.com/in/umanhonlengabriel/)
- [Jeet Pal](https://www.linkedin.com/in/jeet-pal-22601a290)
- [Pavan Baile](https://www.linkedin.com/in/pavan-baile-0bb596244)

*For security reasons, we don't publish details of individual vulnerabilities.*

## 📞 Contact

- **Security vulnerabilities / bug bounty reports**: security@meingpt.com
- **General questions**: support@meingpt.com