If you’ve found a security vulnerability on shtinegarden.com, we encourage you to contact us immediately. We review legitimate security reports and aim to address valid issues as quickly as reasonably possible.

Before reporting a vulnerability, please review this document, including our reporting principles, reward program, reward guidelines, and non-reportable issues.

FUNDAMENTALS

If you follow the principles below when reporting a security issue to shtinegarden.com, we will not initiate legal action or enforcement investigations against you in response to your good-faith security report, subject to applicable law.

We ask that you:

  • Give us reasonable time to review and address the issue before disclosing it publicly or sharing it with others.
  • Do not interact with or access private accounts without the account owner’s consent.
  • Make a good-faith effort to avoid privacy violations, service disruptions, data destruction, or interruption of our services.
  • Do not exploit a vulnerability beyond what is reasonably necessary to demonstrate the security issue.
  • Do not access, modify, download, retain, or disclose sensitive information that does not belong to you.
  • Do not use a vulnerability to obtain unauthorized access to accounts, systems, or data.
  • Comply with all applicable laws and regulations.

BOUNTY PROGRAM

We recognize the contributions of security researchers who help us identify and address vulnerabilities.

Security rewards may be awarded at Shtinegarden LLC’s discretion based on the severity, risk, impact, exploitability, and quality of the submitted report.

To potentially qualify for a reward, you must:

  • Follow the security reporting fundamentals listed above.
  • Report a valid security vulnerability that presents a meaningful privacy or security risk.
  • Submit your report through our designated security contact method rather than contacting individual employees directly.
  • Disclose any accidental privacy violations, data exposure, or service disruptions that occurred during your testing.
  • Understand that while we review legitimate reports, priority is determined based on risk and impact, and a response may take some time.
  • Understand that Shtinegarden LLC may publish information about resolved security vulnerabilities where appropriate, while taking reasonable steps to protect sensitive information.

REWARDS

Rewards are based on the impact and severity of the reported vulnerability. Please provide detailed, clear, and reproducible steps so our team can verify the issue.

If a reported issue cannot be reproduced or does not present a meaningful security risk, it may not qualify for a reward.

  • The first valid report of a previously unknown issue may receive the applicable reward.
  • Multiple bugs caused by the same underlying vulnerability may be treated as a single report.
  • Rewards are assessed based on impact, exploitability, severity, and report quality.
  • Shtinegarden LLC reserves the right to determine the final reward amount.

Current Maximum Reward Amounts

Critical Severity – $200

Examples may include:

  • Remote Code Execution
  • Remote Shell or Command Execution
  • Vertical Authentication Bypass
  • SQL Injection resulting in unauthorized access to targeted sensitive data
  • Full unauthorized account access

High Severity – $100

Examples may include:

  • Lateral Authentication Bypass
  • Disclosure of sensitive internal data
  • Stored Cross-Site Scripting (XSS) affecting other users
  • Local File Inclusion
  • Insecure handling of authentication credentials or session information

Medium Severity – $50

Examples may include:

  • Significant logic or business-process vulnerabilities
  • Insecure Direct Object References
  • Other vulnerabilities with a meaningful but limited security impact

Low Severity – Recognition Only

Examples may include:

  • Open redirects
  • Reflected XSS with limited impact
  • Low-sensitivity information disclosures
  • Other issues that do not present a significant security risk

Rewards are discretionary and may be changed or discontinued by Shtinegarden LLC at any time.

CONTACT INFORMATION

Shtinegarden LLC

📍 Address: 41 Wilkins Peak Dr, Rock Springs, WY 82901, USA

✆ Phone: +1 307-466-6344

✉ Email: support@shtinegarden.com

🌐 Website: shtinegarden.com