RewardVane

Security

Report a vulnerability

Found a way to break into RewardVane, to read what is not yours, or to make it do what it should not? Tell us. We read every security report, and we acknowledge it within 1 day.

How to report

  1. Write to us

    Email the address on this page, or send the contact form and say it is a security report. Either way it goes to our priority queue.

  2. Tell us what you found

    Say what you did, what you expected and what happened, with the page or API address and the time. A short proof is enough. Leave real people’s data out: stop as soon as you can show the problem.

  3. We confirm and fix

    A person acknowledges your report within 1 day, tells you whether we can reproduce it, and keeps you posted until it is fixed.

Security reports go to

service@rewardvane.com
Use the contact form

Machine-readable contact details (RFC 9116): /.well-known/security.txt

What is in scope

In scope

  • The RewardVane website and account service at rewardvane.com, including the sign-in of the admin console and everything behind a sign-in.
  • The RewardVane apps and browser extension, as released through the stores.
  • The APIs they call: sign-in, sync, purchase checks and the AI agent connection.

Out of scope

  • Findings that need a rooted or jailbroken device, or physical access to someone’s unlocked phone.
  • Social engineering of our team or our users, spam, and denial-of-service or volume testing.
  • Missing security headers or cookie flags with no shown impact, and automatic scanner output with no proof.
  • Third-party services we use, such as our payment, email and hosting providers: report those to the provider.
  • Accounts or data that are not yours. Use your own test account.

What we ask, and what you can expect

What we ask

  • Give us a reasonable time to fix the problem before you tell anyone else.
  • Use only accounts and data that are yours. Do not read, change or keep other people’s data.
  • Do not run tests that slow the service down for others, and stop once you have shown the problem.

What you can expect

  • An acknowledgement within 1 day.
  • Updates until the problem is fixed. We aim to fix serious problems within 90 days.
  • Credit by name in the changelog, if you want it.
  • No legal action from us over research that follows these terms and is done in good faith.

We are a small team and do not run a paid bug bounty. We would rather say so than promise a reward we cannot give.