If you think you have found a security problem in 50heads, we want to hear about it, privately and first. This page says how to report it, what is covered, what to expect from us and what we ask of you. It is a good-faith policy, not a contract, and it is not legal advice. More about how we protect 50heads is on the security page.

How to report

Use the contact form and choose Security. It files a ticket that our team sees. We do not publish a security mailbox; the same form is named in our security.txt.

Please write in English if you can, and include:

  • what you found and where (the address, the screen or the endpoint);
  • the steps to reproduce it, and what you saw;
  • what you think someone could do with it;
  • how to reach you, and the name you would like us to use if we thank you.

Please do not put passwords, keys, other people's personal data or exploit files in the form. If you need to send something sensitive, say so and we will arrange a way to receive it.

What is covered

  • 50heads.com, api.50heads.com, mcp.50heads.com and auth.50heads.com.
  • The 50heads apps for iOS and Android.
  • The packages we publish: @50heads/mcp and @50heads/cli.

What is not covered

  • Denial-of-service or load testing, and anything that degrades the service for other people.
  • Social engineering, phishing or physical attacks against staff, heads or requesters.
  • Reports that only say a security header, DNS record or email setting is missing, with no way to use it.
  • Findings in services we rely on, such as Stripe, Wise, Cloudflare or Resend. Please report those to the provider.
  • Accounts, questions or data that are not yours.

What we ask of you

  • Test only with accounts you own, and stop as soon as you have shown the problem exists.
  • Do not read, change, keep or share other people's data. If you come across any, stop, tell us, and delete it.
  • Do not disrupt the service or move real money through it.
  • Give us reasonable time to fix the problem before you tell anyone else. We will agree a date with you, and we aim to fix serious problems quickly.

What to expect from us

  • We will reply to every report.
  • We will tell you whether we think it is a real problem, and keep you updated until it is fixed.
  • We will not ask you to sign anything before we look at your report.
  • If you would like, we will thank you by name on the security page once it is fixed.

Safe harbour

If you follow this policy and act in good faith, we will not start legal action against you, or ask the police to, for research that stays inside it. We will say so to anyone who asks us about your report.

We cannot speak for other people. This page does not bind a third party whose systems you touched, a prosecutor, or a regulator, and it does not allow you to break the law. If you are unsure whether something is allowed, ask us first through the form before you test it.

No bounty yet

We do not pay for reports at the moment. We would rather say so than let you find out later. If that changes, it will be on this page first.