We use cookies for site analytics. Accept to help us understand how the site is used. See our Privacy Policy for details.
Bug Reports & Security
Found something broken or a security issue? We want to hear about it. Whether it's a UI glitch, broken feature, or security vulnerability - your reports help us improve gitGood.dev for everyone.
Report a Bug
If you've found a bug - something not working as expected, a broken feature, UI issues, or any other problem - please let us know. Include as much detail as possible: what you were doing, what you expected to happen, and what actually happened.
Bug Bounty & Rewards
We run a bug bounty program for both security vulnerabilities and high-impact non-security bugs. Valid reports are rewarded with a free month of gitGood.dev Premium, an exclusive Bug Hunter badge on your profile, and public recognition (with your permission).
Eligible security vulnerabilities include:
Arbitrary code execution
SQL injection
Privilege escalation (from unauthenticated user or to admin users)
Authentication bypass for login
Circumvention of permission model for apps or admin users
Cross-site request forgery
Cross-site scripting - See the next section for limitations
Eligible high-impact non-security bugs are issues that meaningfully block or break the product for real users. Examples:
Account-recovery or login dead-ends (e.g. a state a user can't recover from)
Data loss or corruption of user progress, submissions, or saved work
A core flow that is broken end-to-end (practice, interviews, coding/SQL execution, checkout, email actions)
Incorrect billing, access, or entitlement state (charged wrong, locked out of paid features)
Reproducible crashes or errors that block a whole page or feature
The bar is impact, not polish. Cosmetic glitches, copy typos, minor layout issues, and low-impact edge cases are always welcome via the report form above and may earn Hall of Fame recognition, but they don't qualify for the bounty reward. We decide eligibility and severity at our discretion.
Security & UX Hall of Fame
With gratitude to the researchers and users who responsibly disclosed a valid issue and helped improve gitGood.dev - whether a security vulnerability or a significant UX, account-recovery, or functional bug. Listed with permission.
#1
Hassan JawaidValid report
Personal information disclosure via public profile field
2026-06
#2
Naveed QadirValid report
Multiple account-security reports: unconfirmed-signup lockout recovery, re-auth before account deletion, all-device sign-out, and follow-up on the account-deletion step-up enforcement
2026-06
#3
Tanish SainiValid report
Account-deletion step-up bypass via client-side response tampering; access token not invalidated on logout (replayable until expiry); duplicate-account limit bypass via email plus-aliasing at signup
2026-06
#4
Nujella S.S.N.V Ravindra KumarValid report
Account-deletion follow-up report that prompted a full audit of the deletion path: post-deletion token revocation, profile re-creation, and subscription/data teardown hardening
2026-07
Known Issues or Excluded Vulnerabilities
The following reports are not considered as vulnerabilities or are not subject of this bug bounty program. Please do not report any of the following issues:
Any issue where staff users are able to insert JavaScript in their content
Any issue related to execution of JavaScript in the Rich Text Editor
Cross-site scripting that requires full control of a HTTP header, such as Referer, Host etc.
Arbitrary file upload to the CDN server
Insecure cookie handling for non-sensitive cookies
Incorrect/No cookie expiration
CSRF for Login, Logout and Signup pages
Issues with the SPF, DKIM or DMARC records for gitGood.dev domains or mail system abuse
User enumeration
Missing "X-Content-Type-Options" HTTP header with nosniff value
Content Spoofing on error and restore password page
Any kind of brute force attacks on our services
Ineligible Vulnerability Types
gitGood.dev does not consider the following to be eligible vulnerabilities under this program:
Denial of Service
Social Engineering, including phishing
Failure to implement security best practices such as rate limiting, minimum password strength
Any issue that can only be exploited by physical access to someone's device or debug access being enabled, or that depends on a vulnerability in the operating system
Architectural decisions knowingly made by gitGood.dev are not considered as valid submissions even if there may be a more secure alternative configuration
Rules for Participation
The following rules must be followed in order to get any rewards:
Don't attempt to gain access to another user's account or data
Don't perform any attack that could harm the reliability/integrity of our services or data. DDoS/spam attacks are not allowed
Don't publicly disclose a bug before it has been fixed
Allow a reasonable amount of time for gitGood.dev to respond to your vulnerability report before publishing details of your exploit
Only test for vulnerabilities on sites you know to be operated by gitGood.dev
Do not impact other users with your testing, this includes testing for vulnerabilities in repositories you do not own. We may suspend your gitGood.dev account and ban your IP address if you do so
Don't use scanners, scrapers or any other automated tools in your testing. They're noisy and we may suspend your gitGood.dev account and ban your IP address
Never attempt non-technical attacks such as social engineering, phishing, or physical attacks against our employees, users, or infrastructure
Rules for Us
We will respond as quickly as possible to your submission
We will keep you updated as we work to fix the bug you submitted
We will not take legal action against you if you play by the rules
Contact
For bug reports and security vulnerability submissions, please use the form at the top of this page.
For security issues, please allow us reasonable time to address the vulnerability before public disclosure.