Report a Security Issue &
Responsible Disclosure
We value the global cybersecurity research community. If you have discovered an application vulnerability, access-control loophole, or ledger inconsistency affecting PiggyTask, we encourage you to report it directly to our security engineering team.
Safe Harbor Protection
We pledge full legal protection and zero civil lawsuits for ethical hackers testing within our stated rules of engagement.
High-Priority Triage
Security tickets bypass standard user support queues and go directly to security engineers for CVSS reproduction.
Researcher Recognition
Researchers who report qualifying, original vulnerabilities receive formal placement on the PiggyTask Security Hall of Fame.
End-to-End Encryption
Submit sensitive proof-of-concept exploits via our PGP 4096-bit public key or directly through the encrypted intake form below.
Scope & Target Assets
Our Vulnerability Disclosure Program encompasses primary production systems responsible for member authentication, financial task credit tracking, ledger transactions, and payout processing across Bank Transfers, Crypto (USDT/LTC), and Local Airtime channels.
| Target Asset / Endpoint | Environment | Classification |
|---|---|---|
https://piggytask.com & *.piggytask.com |
Production Web App | In Scope |
https://piggytask.com/api/v1/* |
REST & Internal APIs | In Scope |
| Authentication, OAuth, Session & Password Reset Flows | Identity Layer | In Scope |
| Payout Webhook Ingestion & Financial Ledger Logic | Payment Processing | In Scope |
| Third-Party Offerwalls (CPALead, AdGate, BitLabs iframes) | External Partner Infra | Out of Scope |
| Cloudflare Edge CDN DNS / Physical Datacenter nodes | Infrastructure Provider | Out of Scope |
Qualifying Vulnerabilities
We prioritize security reports that demonstrate genuine threat impact on data confidentiality, account integrity, or financial ledger security. Qualifying vulnerability classes include:
| Vulnerability Class | Typical Severity | Description & Impact Vector |
|---|---|---|
| Balance Race Conditions / Postback Forgery | Critical | Manipulating concurrency locks during withdrawal or forging task postback signatures to fabricate unearned balances. |
| Broken Object Level Auth (BOLA / IDOR) | High | Accessing or altering another earner's wallet addresses, bank accounts, task submissions, or personal information via parameter tampering. |
| Server-Side Code Execution (RCE) & SQLi | Critical | Arbitrary command execution, SQL injection in query parameters, or deserialization flaws in API payloads. |
| Server-Side Request Forgery (SSRF) | High | Forcing backend workers to query internal metadata services (e.g. AWS/GCP IMDS) or unauthenticated internal microservices. |
| Stored Cross-Site Scripting (XSS) | High | Persistent script injection executing in other users' browsers or administrative oversight panels. |
| Privilege Escalation | Critical | Elevation of standard earner permissions to administrator, moderator, or financial auditor roles. |
| Authentication & Session Bypass | High | Flaws in password reset token generation, session invalidation on logout, or multi-factor authentication bypass. |
| Subdomain Takeover | Medium | Orphaned DNS records (CNAME/Alias) pointing to decommissioned cloud resources on active *.piggytask.com domains. |
Out-of-Scope Exclusions
To ensure engineering resources remain focused on substantive threats, the following non-qualifying findings are considered strictly out-of-scope:
- Social Engineering & Phishing: Any attempt to phish, spear-phish, pretext, or socially engineer PiggyTask staff, moderators, or users.
- Denial of Service (DoS / DDoS): Volumetric traffic flooding, slowloris attacks, or resource exhaustion designed to degrade platform availability.
- Automated Scanner Reports: Bulk automated tool outputs (e.g., Nessus, Acunetix, sqlmap raw logs) without an executable, step-by-step reproduction proof-of-concept.
- Missing Security Headers: Informational findings (such as missing CSP, X-Frame-Options, or HSTS) unless demonstrated to lead to immediate exploitation.
- Self-XSS & Client-Side Manipulation: Injections that require the user to paste JavaScript into their browser console or modify their local storage.
- Email Spoofing / DMARC: SPF/DKIM/DMARC informational records on secondary sending subdomains with no demonstrated delivery spoofing vector.
- Physical Attacks: Physical intrusion into offices or hosting infrastructure.
- Vulnerabilities in Unsupported Browsers: Flaws that only trigger on outdated, deprecated client browsers (e.g. Internet Explorer).
Safe Harbor & Rules of Engagement
We consider good-faith security research authorized under applicable computer crime laws. PiggyTask pledges not to pursue civil litigation or initiate law enforcement action against researchers who adhere to this policy.
Researcher Code of Conduct:
- Stop When You Reach Private Data: If you discover a vulnerability that exposes personal information, ledger records, or credentials belonging to other users, stop testing immediately and report your finding. Do not dump or store the data.
- Do Not Alter User Balances: Never attempt to modify or deplete real funds. Test balance logic solely between your own dual testing accounts.
- Provide a Reasonable Fix Window: Allow our security engineers sufficient time to reproduce, develop, and deploy fixes before publicly discussing the issue.
- Act in Good Faith: Never demand extortion payments, bug bounties under threat of public disclosure, or attempt to monetize user data.
Submit a Security Report
Use the encrypted intake form below to submit your vulnerability details directly to our security engineering team. All submissions are triaged with high urgency.
Security Report Received
Thank you for responsibly disclosing this issue to PiggyTask. Your ticket has been assigned to our security triage queue under reference ID:
A security engineer will review your reproduction steps within 24 to 48 hours and follow up via your registered email address.
Remediation Lifecycle & Disclosure Process
We follow a transparent, structured engineering lifecycle for every validated security report. Here is what to expect after your ticket is submitted:
Ingestion & Initial Acknowledgment 24–48 Hours
Your submission is assigned a unique reference ticket ID. A security triage engineer verifies receipt and checks for existing duplicates in our database.
Reproduction & CVSS Scoring Day 2 – Day 4
Our security engineers reproduce the vulnerability in an isolated staging environment, assign a calibrated CVSS 3.1 score, and validate the impact rating with you.
Patch Development & Peer Review Priority Track
The responsible feature team drafts an atomic fix, adds automated regression tests, and submits the pull request for defensive security audit.
Production Deployment & Re-Test Verified
Once deployed to production, we notify you and invite you to re-test the endpoint to confirm the mitigation is complete and robust.
Hall of Fame Induction & Coordinated Disclosure Attribution
Your handle is formally inscribed on the PiggyTask Security Hall of Fame. Coordinated public write-ups are permitted after a standard 30-day stability buffer.
Security Hall of Fame
We extend our profound appreciation to the ethical security researchers who have helped protect PiggyTask's earners, infrastructure, and financial ledger integrity:
Alex Cipher (@alexcipher) Critical
Reported a race condition on withdrawal balance locking. Coordinated fix deployed.
Maya Nair (@sec_maya) High
Identified BOLA/IDOR vulnerability in earning history export endpoints.
David Kovacs (@dkovacs_sec) High
Disclosed session token invalidation omission across concurrent mobile logins.
Sarah Lin (@slin_cyber) Medium
Discovered open redirect vector in localized referral route forwarding.
PGP Public Key & Direct Channel
For researchers reporting critical zero-day discoveries or who prefer encrypted email communications, please encrypt all sensitive attachments and proof-of-concept exploits using our official GPG/PGP public key:
Key Fingerprint:
4F82 A9B1 C43D E762 901F 6B21 D8E3 52A9 1B74 892C