Vulnerability Disclosure Program
Effective: September 2026 • Version 1.0 • Security Contact: [email protected]
Acknowledgment-Based Program (No Cash Bounties)
Community recognition & Hall of Fame honors for ethical researchers
PodBanter is an early-stage, bootstrapped AI audio platform. We deeply appreciate the security community's support in keeping our users, document ingestion pipelines, and interactive audio streams secure.
- ✓Permanent induction into our official Security Hall of Fame
- ✓Public recognition & backlink to your X, Reddit, GitHub, or LinkedIn profile
- ✓Verifiable letter of appreciation / recommendation for your security portfolio
- ✓Complimentary Pro subscription tier & early preview access to upcoming AI features
* Please note: We do not offer cash rewards, monetary bounties, or paid penetration testing engagements at this stage. We ask that researchers participate under our responsible disclosure terms.
1. Program Scope
Only security flaws discovered within the following services and endpoints are eligible for review and Hall of Fame acknowledgment:
- •PodBanter Web Application (
podbanter.com&app.podbanter.com) - •Backend REST APIs (
/api/v1/..., auth, billing, documents, episodes) - •Authentication bypass, JWT tampering, and privilege escalation
- •Server-Side Request Forgery (SSRF) in document/URL extractors
- •Insecure Direct Object References (IDOR) on private episodes and feeds
- •SQL Injection, NoSQL Injection, and Remote Code Execution
- •Denial of Service (DoS / DDoS) or brute-force stress testing
- •Social engineering, phishing, or physical attacks on staff
- •Automated vulnerability scanner dumps without a reproducible PoC
- •Clickjacking on static pages with no sensitive state change
- •Missing SPF/DKIM/DMARC records or rate limits without demonstrated impact
- •Third-party providers (e.g., Stripe, ElevenLabs, Cloudflare) out-of-band
2. Safe Harbor Commitment
We consider research conducted under this policy to be authorized. If you make a good-faith effort to comply with this policy during your security research, PodBanter will:
- Not pursue civil litigation or initiate legal complaints against you.
- Not report your activities to law enforcement, provided you do not violate privacy or tamper with production data.
- Work with you to understand and resolve the issue quickly and collaboratively.
- Publicly acknowledge your responsible discovery on our Security Hall of Fame.
3. Ground Rules for Testing
• Test Only on Your Own Accounts: Always register test accounts for research. Never inspect, modify, or exfiltrate another user's documents, transcripts, or credentials.
• Avoid Disruption: Do not degrade user experience, exhaust shared API quota (e.g., ElevenLabs voice tokens), or cause downtime.
• Coordinated Disclosure: Do not publish, tweet, or disclose vulnerability details until we have investigated and deployed a verified patch (standard 90-day coordinated window).
4. How to Submit a Vulnerability Report
Please email your findings directly to our security team at:
Subject: [Vulnerability Report] <Brief Title, e.g. IDOR in Episode Retrieval> 1. Summary of Vulnerability: [Short explanation of the issue and potential risk] 2. Severity Assessment: [Critical / High / Medium / Low] 3. Affected URL / Component: [e.g., POST /api/v1/documents/parse-url] 4. Step-by-Step Reproduction: Step 1: ... Step 2: ... Step 3: ... 5. Proof of Concept (PoC): [HTTP request snippet, script, screenshot, or video link] 6. Remediation Recommendation: [Optional suggested fix or patch guidance] 7. Preferred Hall of Fame Attribution: [Name/Handle, and link to your X, Reddit, GitHub, or LinkedIn]
5. Our Response & Triage Commitments
Confirmation that your report was received and assigned to a lead engineer.
Verification of vulnerability severity, reproducibility, and scope status.
Deployment of the fix, credit notification, and listing in the Hall of Fame.
Ready to check our recognized researchers?
Explore the contributors who have made PodBanter safer for everyone.