Security
Security Policy
We welcome reports of security vulnerabilities. Please email security@steadyhq.com with:
Description of the issue
Affected URLs/endpoints
Steps to reproduce
Expected vs actual behavior
Proof-of-concept (text only, no live exploits)
Principe
C'est le public qui décide quelles publications méritent un soutien financier, et non Steady. Nous ne sommes pas une maison d'édition ou un bureau de rédaction et Steady ne suit aucune ligne directrice éditoriale. Nous n'interférons pas avec le contenu des éditeurs.
La liberté d'expression est importante pour nous. Par conséquent, nous ne sanctionnons pas nécessairement la publication de contenus qui nous déplaisent, même si cela est difficile à supporter. Nous intervenons le moins possible dans la liberté des éditeurs qui utilisent Steady. Cela inclut la liberté de proposer des contenus payants que tout le monde n'accepte pas, y compris l'équipe de Steady.
Mais nous avons certaines limites. Ces consignes décrivent où nous fixons la limite.
Rules of Engagement
No DoS, stress tests, or automated scans beyond normal rate limits.
Do not access, modify, or exfiltrate data that isn’t yours. Use test data only.
Test only accounts you own or have explicit permission for.
Stop immediately if you encounter sensitive data and report privately.
Our Commitment
Acknowledge reports within 3 business days.
Provide triage updates within 7 business days.
Fix timelines depend on severity and complexity.
Safe Harbor
We will not pursue legal action for good-faith testing and disclosure that follows this policy.
Recognition & Rewards
We offer the following bounty tiers for valid, in-scope vulnerabilities. Severity is determined by us based on impact and exploitability:
Low: $100
Medium: $300–$500
High: $1,000
Please note:
Not all submissions will qualify for a reward. Trivial findings, best-practice recommendations, or issues without clear security impact are not eligible for payouts.
Rewards are granted at our discretion, based on severity and impact.
Only the first valid report of a vulnerability will be eligible for a reward.
With your permission, we may also credit you publicly after a fix and deployment.