Vulnerability Disclosure & Bug Bounty Program

Our commitment

Deck welcomes reports from security researchers and will not pursue legal action against good-faith research that follows this policy. Our customers trust us with their data and the systems our agents connect to, and fixing vulnerabilities quickly is how we keep that trust.

Scope

Only the assets listed as in scope may be tested. Anything not listed is out of scope.

Rules of engagement

You are authorized to test in-scope assets only if you follow all of these rules.

• Test only with accounts you create through self-serve signup at console.deck.co. Include "bugbounty" and your handle in the account's organization name so we can recognize it. Never use another person's credentials or account.
• Do not access, modify, or keep data that isn't yours. If you reach customer data, credentials, or personal information, stop, take only what proves the issue, and report it right away.
• Do not pivot. Once you have shown impact, do not use the access to reach other systems.
• Keep automated scanning under 5 requests per second. Add the header Deck-Research: <your handle> to your traffic so we can recognize it.
• No denial of service, load testing, or anything that degrades the service for others.
• No social engineering, phishing, or physical testing of Deck staff, contractors, or customers.
• Testing happens on production, shared with our customers. Point Deck agents only at websites and accounts you own, never at third-party portals (see Scope).
• Delete any Deck data you hold within 30 days of reporting, or sooner if we ask.
• Keep findings confidential until we agree on disclosure (see What to expect).
• Comply with all laws that apply to you.

Not eligible

The following are not eligible for rewards unless you show a concrete, exploitable security impact.

• Findings from automated scanners without a working proof of concept
• Missing security headers, cookie flags, or best-practice settings with no demonstrated exploit
• SPF, DKIM, or DMARC configuration
• Clickjacking on pages with no sensitive action
• CSRF on logout or other actions with no security impact
• Self-XSS, or issues that require the victim to paste content into their own browser
• Rate limiting or brute force issues with no realistic account takeover path
• User or email enumeration
• Software version disclosure, banner grabbing, or verbose error pages with no sensitive data
• TLS/SSL configuration findings (cipher suites, protocol versions)
• Issues that need a rooted, jailbroken, or already-compromised device
• Issues only in outdated or unsupported browsers
• Leaked credentials found online that you did not verify against Deck
• Vulnerabilities in third-party software with no Deck-specific impact, or disclosed less than 30 days ago
• Denial of service

How to report

Email [email protected]. One vulnerability per report, unless several issues chain together into one impact.

A good report includes:

• The affected asset (URL, API endpoint, or component)
• The vulnerability type and a short summary of its impact
• Step-by-step instructions to reproduce it, with the requests and responses
• A proof of concept (screenshots, video, or script)
• Your suggested severity and why
• Any data you accessed, and confirmation that you deleted it
• How you'd like to be credited, if at all

Do not include customer data, credentials, or personal information beyond what's needed to prove the issue. Reports with demands for payment before disclosure details are shared will not be treated as good-faith reports.

What to expect

We aim to meet these targets. We are a small team and will tell you if we expect to miss one.

Coordinated disclosure. Please give us 90 days from your report before publishing anything. We may ask for more time for complex fixes, and may agree to less once the fix is live. We will review your write-up before publication to make sure it contains no customer data. We do not publish CVEs or advisories by default, but will credit you if we do.

Rewards

Rewards are paid at Deck's discretion, based on the real impact to Deck and our customers. We start from CVSS v4.0 and adjust for context.

To be eligible:

• You are the first to report the issue. Duplicates go to the earliest complete report.
• The issue is in scope, reproducible, and not on the Not eligible list.
• You followed the rules of engagement.
• You are not a current or former (within 12 months) Deck employee or contractor, or their immediate family.
• We are legally able to pay you. We cannot pay residents of countries under Canadian sanctions. You are responsible for any taxes.

Multiple issues with the same root cause are rewarded as one. A clear report with a good proof of concept may earn more within the range. Payment is made by wire transfer (including Wise) or PayPal.

Safe harbor

If you make a good-faith effort to follow this policy, Deck considers your research authorized. Specifically, we will:

• Not pursue or support legal action against you for that research, including under Canada's Criminal Code (s. 342.1 and s. 430(1.1)), the U.S. Computer Fraud and Abuse Act, or similar laws
• Waive restrictions in our Terms of Service that would otherwise prohibit that research, for the limited purpose of this program
• Make it known that you acted in good faith if a third party brings legal action against you over research covered by this policy

This safe harbor covers Deck systems only. We cannot authorize testing of systems we don't own, including the third-party portals Deck agents connect to. If you're unsure whether something is in scope or allowed, ask us at [email protected] before you test.

Recognition and changes

With your permission, we will credit you on our Security Acknowledgments page once the issue is fixed. You choose the name or handle we use.

This policy is published at deck.co/bug-bounty. We may update it at any time. The version in effect when you submit your report applies to it. Our machine-readable contact is published at deck.co/.well-known/security.txt.