Responsible disclosure

How to report

If you find a security issue in Burnproof, email hello@burnproof.dev. Describe what you saw, the URL, and the steps to reproduce it. Please give us time to fix it before you publish details.

Scope

This policy covers the site and API at burnproof.dev, including www.burnproof.dev. Checkout pages hosted by Polar are outside this policy. Report those to Polar.

Good-faith research

Look only at what you need to show the issue. Do not access, change, or delete data that belongs to someone else. Do not use Burnproof to hunt for keys, customer data, or source code on sites you do not own. Do not run denial-of-service, spam, or social engineering against us or our customers.

A report that follows this policy will not be met with legal action from NextPlay Solutions. We do not run a paid bounty program.

What happens next

We aim to reply within three business days. We will tell you when a fix is live, or if we need more detail. Please wait until then before you share the issue publicly.

The machine-readable policy is at /.well-known/security.txt.