SECURITY
Responsible disclosure
How to report a security issue, what's in scope, and what to expect from us.
On this page
Report a vulnerability
Email us directly with what you found. Include enough detail to reproduce it — steps, the affected URL or endpoint, and the impact.
We aim to acknowledge security reports within one business day.
Scope
In scope
predicthere.com and its subdomains, and the APIs served from them.
Out of scope
Third-party services we depend on but don't operate — Vercel, Supabase, our RPC and market-data providers, WalletConnect/Reown, and the underlying blockchain infrastructure. Report those directly to the vendor.
Testing guidelines
Don't degrade the service for other users, access or modify data that isn't yours, or attempt social engineering against our team. If you're unsure whether something is in scope, ask first.
Encrypted reports
We don't currently publish a PGP key. If encryption matters for your report, say so when you write in and we'll agree on a secure channel.
Safe harbor
We don't yet have formal legal safe-harbor terms for good-faith security research — stated plainly rather than implied. Testing within the scope and guidelines above, and reporting promptly and privately, is exactly the kind of report we want to receive.