Help us keep Handle safe.
Security researchers and bug hunters are welcome here. Email us what you find, and we'll reply within 72 hours, usually much sooner.
- Contact: mailto:security@handle.pub
- Expires: 2027-10-01T00:00:00Z
- Preferred-Languages: en
- Policy: https://handle.pub/security
- Acknowledgments: https://handle.pub/security/credits
Line 4 points here. You're reading the policy.
- 01 · YouEmail a reportURL or endpoint, steps to reproduce, and impact.
- 02 · UsReply in 72 hoursUsually much sooner. A person reads every report.
- 03 · TogetherFix, then discloseWe agree on timing before anything goes public.
- 04 · YouSwag and creditSwag for valid findings. Credit if you want it.
No AI slop.
We don't accept automated or AI-generated reports. Send something you've reproduced yourself and can explain, and we'll give it our full attention.
In bounds
- Testing with your own account and handle
- Using your own handle when an endpoint might return PII
- Coordinating disclosure with us
Out of bounds
- Accessing other people's personal information
- Denial of service or load testing
- Spam, phishing, or social engineering
Safe harbor
Good-faith research that follows this page is authorized. We won't take legal action against you, and we'll work with you to fix the issue. Not sure? Ask first.
We can't pay bounties. We can say thanks.
We're a small team, so there's no monetary compensation. Valid findings get Handle swag and, if you'd like, a line on our security credits page.