SECURITY POLICY
Responsible disclosure.
Last updated: June 1, 2026
If you found a vulnerability in 38matches.club or app.38matches.club, we want to know. Here are the rules for reporting it safely and the commitments we make in return.
- 01
Scope
In scope: 38matches.club, www.38matches.club, app.38matches.club and their subdomains, public API endpoints (/api/apply, /api/stripe-webhook), emails to [email protected] with subject starting "[SECURITY]". Out of scope: physical attacks, social engineering of staff, brute-force DDoS, third-party service vulnerabilities (Supabase, Stripe, Cloudflare — report directly to them).
- 02
How to report
Email [email protected] with: vulnerability description, reproduction steps, estimated impact. We acknowledge receipt within 5 business days. If you prefer encrypted, use the PGP key published at /.well-known/pgp-key.txt.
- 03
Our commitments to you
We will not take legal action against researchers acting in good faith within this program. We will credit you in release notes if you want (or keep your identity private). No NDA required. We pay reasonable bounties for High/Critical findings (USD $50–$2,000 based on severity and impact — paid via bank transfer or crypto).
- 04
Rules for researchers
Do not exfiltrate member data — if you find an RLS escape, demonstrate it with your own account. Do not degrade service for other users. Do not automate scans generating more than 100 req/min. Do not publish the vulnerability before we fix it (we will tell you when it is safe for public disclosure).
- 05
Severity and SLA
Critical (RCE, RLS escape, broken auth): respond in 24h, fix in 7 days. High (reflected/stored XSS, member IDOR, PII leakage): respond in 48h, fix in 30 days. Medium (CSRF in non-critical flows, low-impact information disclosure): respond in 5 days, fix in 60 days. Low (insufficient rate limit, missing header): respond in 10 days, fix in 90 days.
- 06
Stack and defensive posture
Next.js 14 static on Cloudflare Pages. Supabase Postgres with strict RLS. Stripe Checkout (we do not store cards — SAQ-A scope). Magic-link auth (no passwords). Cloudflare WAF + Turnstile on intake. TLS 1.3 with hybrid post-quantum encryption (X25519+ML-KEM). Audit logs for staff actions. No third-party analytics, no advertising trackers.