Reporting a security issue

The100 is a small, largely volunteer-run community site, and we genuinely appreciate people who take the time to tell us about security problems. If you have found something, email [email protected] and we will read it.

A report is most useful when it includes the affected URL or endpoint, the steps to reproduce it, and what an attacker could actually do with it. Please give us a reasonable amount of time to respond before disclosing publicly.

No bug bounty

We do not run a bug bounty program and we do not offer monetary compensation, swag, or rewards for security reports. The100 is funded by a small number of community donors, and every dollar goes to keeping the servers running. We are happy to credit researchers who report a genuine issue and ask to be named, but please do not send a report expecting payment — the answer will be no, no matter how the report is framed.

In scope

  • The100.io web application and its API
  • Our Discord bot, insofar as it affects The100 accounts or data

Out of scope

The following are, by themselves, not things we treat as vulnerabilities. Reports consisting only of automated scanner output on these topics will be acknowledged but not acted on, and are not eligible for credit:

  • Missing or "weak" DNS-level email hardening — MTA-STS, DANE, DNSSEC, CAA, BIMI, SPF ~all vs -all, or a DMARC policy of p=none
  • Missing HTTP security headers (CSP, HSTS preload, X-Frame-Options and friends) with no demonstrated exploit
  • Missing rate limiting, or email/username enumeration, with no demonstrated impact
  • Self-XSS, clickjacking on pages with no sensitive state-changing action, and issues that require a fully compromised device or browser
  • Software version disclosure, banner grabbing, and "outdated library" findings with no working proof of concept against our deployment
  • Denial of service, volumetric or load testing, and social engineering of our staff, volunteers, or users
  • Vulnerabilities in third-party services we use, which should be reported to those vendors directly

Ground rules

Please do not access, modify, or delete data belonging to other users; do not run scans that degrade the service for the people using it; and do not use social engineering, phishing, or physical attacks against anyone. Testing that stays within these rules and is reported in good faith is welcome, and we will not pursue action over it.

Our machine-readable contact information lives at /.well-known/security.txt (RFC 9116).