Security & Disclosure

We build hacking challenges, so naturally we take our own security deadly seriously. Here is how to disclose bugs responsibly.

1. Responsible Disclosure Philosophy

If you have discovered a vulnerability in the TryHackThisBitch infrastructure, production APIs, or account services, we welcome and appreciate your report. We commit to working with ethical security researchers in good faith.

2. Reporting Channel & SLA

  • Contact Email: [email protected]
  • Security.txt: Machine-readable policy available at /.well-known/security.txt
  • First Response SLA: Within 48 hours of receipt.
  • Triage & Confirmation: Within 5 business days.
  • Remediation Window: We strive to remediate critical issues within 14 calendar days.

3. Scope

In Scope:

  • Production API endpoints (e.g. flagcheck.tryhackthisbitch.com, api.tryhackthisbitch.com).
  • Authentication, session token management, and account data leakage.
  • Remote Code Execution (RCE), SQLi, Server-Side Request Forgery (SSRF), or IDOR in core services.
  • Cross-tenant leakage on database or backend storage tiers.

Out of Scope:

  • Denial of Service (DoS / DDoS) attacks against platform infrastructure.
  • Spam, volumetric abuse, or automated flooding of forums.
  • Intended game mechanics (e.g. solving simulated client-side challenges by inspecting intended client JS files).
  • Social engineering, phishing, or physical attacks against operators or contributors.

4. Safe Harbor

If you conduct your research in accordance with these principles (no user data destruction, no persistent DoS, timely private disclosure, and no public disclosure before remediation), we will not pursue legal action against you.

5. Bug Bounty & Hall of Fame

We run a bug bounty program to reward ethical researchers who help safeguard our platform and student community. Valid, in-scope security vulnerabilities with a reproducible proof-of-concept are eligible for recognition and rewards:

  • Critical (CVSS 9.0–10.0): Remote Code Execution (RCE), authentication bypass, cross-tenant database access, or unauthorized KV/D1 administrative operations. Reward: Cash bounty consideration + Lifetime Platform Pro Pass + permanent Hall of Fame attribution.
  • High (CVSS 7.0–8.9): Insecure Direct Object References (IDOR) leaking user private data, stored cross-site scripting (XSS) in authenticated contexts, or server-side request forgery (SSRF). Reward: 1-Year Platform Pro Pass + Hall of Fame attribution.
  • Medium (CVSS 4.0–6.9): Cross-Site Request Forgery (CSRF) on state-changing endpoints, rate-limit bypasses on auth/solve routes, or auto-mod bypasses. Reward: Platform Pro Pass + Hall of Fame attribution.
  • Low / Informational (CVSS 0.1–3.9): Security header misconfigurations with demonstrable impact, descriptive error leakage, or edge-case logic flaws. Reward: Hall of Fame attribution + custom researcher badge.

All bounty submissions must be submitted directly to [email protected] with complete reproduction steps.