Security

Security Policy & Responsible Disclosure

Cardoma.shop takes the security of our platform and our customers' data seriously. If you've found a security vulnerability, we encourage you to report it to us directly so we can investigate and fix it.

Last updated: September 2026

Reporting a vulnerability

If you've found a security vulnerability on Cardoma.shop, please contact us immediately at contact@cardoma.shop. We review every legitimate report and aim to resolve confirmed issues quickly.

Before reporting, please read this page in full — including our fundamentals, bounty program, reward guidelines, and what falls outside the scope of this program.

Fundamentals

If you follow the principles below when reporting a security issue to Cardoma.shop, we will not pursue legal action or enforcement investigations against you as a result of your report.

We ask that you:

  1. Give us reasonable time to review and fix the issue before disclosing it publicly or sharing it with others.
  2. Do not access or interact with private accounts without the account owner's consent.
  3. Make a good-faith effort to avoid privacy violations, service disruptions, or data destruction.
  4. Do not exploit the issue for any reason, including to demonstrate further risk or access sensitive data.
  5. Comply with all applicable laws and regulations.

Bounty program

We recognize and reward security researchers who help protect our platform by reporting vulnerabilities. Bounties are awarded at Cardoma.shop's discretion, based on risk, impact, and report quality.

To potentially qualify for a bounty, you must:

  1. Follow the fundamentals listed above.
  2. Report a valid security bug that poses a genuine risk to privacy or security.
  3. Submit your report through contact@cardoma.shop — please do not contact employees directly.
  4. Disclose any accidental privacy violations or service disruptions caused during testing, as part of your report.
  5. Understand that while we investigate all valid reports, priority is based on risk, and a response may take some time.
  6. Agree that we reserve the right to publish submitted reports.

Rewards

Rewards are based on the impact and severity of the vulnerability. Please provide detailed, reproducible steps in your report — issues that cannot be reproduced are not eligible for a bounty.

The first valid report of an issue receives the bounty. Multiple bugs caused by a single underlying issue are treated as one report. Final reward amounts are assessed based on impact, exploitability, and report quality.
Severity Max reward Example issues
Critical $200
  • Remote code execution
  • Remote shell or command execution
  • Vertical authentication bypass
  • SQL injection that leaks targeted data
  • Full account takeover
High $100
  • Lateral authentication bypass
  • Disclosure of sensitive internal data
  • Stored XSS affecting other users
  • Local file inclusion
  • Insecure handling of authentication cookies
Medium $50
  • Logic or business-process flaws
  • Insecure direct object references
Low Recognition only
  • Open redirects
  • Reflected XSS
  • Low-sensitivity information leaks

Report a vulnerability

Send us a detailed, reproducible report and we'll take it from there.

Address
205 6th Ave, Greeley, CO 80631, USA