Cutshort security

1. Email [email protected] with the details needed to recreate the vulnerability. Include screenshots, videos, or clear text steps.
2. Optionally share a phone number so we can reach you if we need more detail.
3. If the issue could extract customer or system data, or impair normal service, do not exploit it in production. That is required for a responsible disclosure.

1. Keep findings confidential. Do not publish or share a write-up without Cutshort’s prior written approval.
2. Test only accounts you own. Do not access, disrupt, or enumerate other users’ accounts or data without our express permission.
3. Threats or coercive disclosure deadlines disqualify you from the program and may lead to legal action.
4. If someone else has already reported the same issue, you are not eligible for a bounty. First valid report wins. Later duplicates get a notice only — no bounty and no listing.
5. Include a working proof of concept. Hypotheticals without a reproducible attack are unlikely to receive a bounty.
6. Automated scanners and AI agents are allowed only if you personally validate the finding, stay within these rules, and do not impair production. Volume of FIND-IDs does not increase the award.

Cutshort’s determination is final. We assess severity from verified impact after reproduction — not from the researcher’s CVSS score, tool labels, FIND-ID count, or a third-party report grade. The category, severity, and award in our reply stand unless you provide new evidence of higher verified impact.

One root cause = one award. The same issue class on sibling endpoints (for example the same missing type check or the same missing rate limit on related login routes) is one valid report, not one award per URL.

Monetary awards are INR 2,500–10,000 per valid report (one report = one issue class above). Valid reporters may also be listed on our security contributors page.

We do not raise an award because a finding is already fixed, because a third-party report graded it higher, or because multiple FIND-IDs share one root cause. We do not negotiate awards after the first valid determination except when new verified impact is shown. Pushback on classification alone does not change the award.

• Remote code execution
• File system access
• Stored cross-site scripting (XSS)
• Server-side request forgery (SSRF)
• Cross-site request forgery (CSRF) on sensitive actions
• Information disclosure (case-by-case)
• Domain take-over
• SQL / NoSQL injection that reaches data or auth decisions
• Authentication bypass (skipping a real auth check)
• Missing rate limiting or captcha on authentication endpoints (login, OTP, password reset, magic link)

• Password policy issues
• Version number or known public file disclosure
• Self-XSS; social engineering; spam
• Missing cookie flags or CSP / TLS “best practice” without exploit
• Account lockout not enforced, by itself
• Rate-limit issues on non-authentication endpoints
• Denial of service or production resource exhaustion
• Known CVE / library reports without a working PoC on Cutshort
• Account squatting; MITM or physical device access
• Clickjacking on pages with no sensitive actions
• CSV injection or content spoofing without a demonstrated attack
• CSRF on unauthenticated or non-sensitive forms
• Open redirect without additional security impact
• Hypothetical subdomain takeovers without evidence
• Unconfirmed automated scanner output
• Client-bundled public API keys or anon keys when row-level security (or equivalent) already blocks unauthenticated data access