Security Policy for PeacefulMindfulPocket LLC

1. Responsible Disclosure

We appreciate responsible disclosure of security vulnerabilities. If you believe you've found a security issue in PeacefulMindfulPocket, please report it to us before disclosing it publicly so we have a chance to address it.

2. Reporting Requirements

When reporting a vulnerability, please include:

• • Detailed steps to reproduce the issue
• • The demonstrated impact of the vulnerability (what you were able to access or do)
• • Any supporting evidence (screenshots, logs, proof-of-concept)

3. Response Timeline

We aim to provide an initial response to all reports within 48 hours. Resolution time will vary depending on severity and complexity of the issue.

4. Reward Tiers

• • Low severity: $25 of BTC
• • Medium severity: $50 of BTC
• • High severity: $125 of BTC

The same person may claim all three tiers across separate, distinct findings. Only the first reported instance of a given issue wins the prize - this page will be updated to reflect claimed tiers.

5. Scope and Eligibility

This program covers genuine security vulnerabilities only - not general bugs, UI issues, or feature requests. Automated scanning is not permitted without prior permission.

Reports must demonstrate an exploitable vulnerability with a working proof-of-concept. Theoretical risks and best-practice suggestions are not eligible for rewards.

Off-limits:

• • Volumetric DDoS attacks
• • The /blog section of the site

Not eligible:

• • Missing or misconfigured security headers without a demonstrated exploit
• • Email configuration findings (SPF, DKIM, DMARC)
• • Clickjacking on pages with no sensitive actions
• • Software version disclosure or banner information
• • Unverified output from automated scanners

6. Contact Us

To report a security issue, please reach out using the contact below: