Report Security Issues

Report Security Issues

Last updated: 27 September 2026

If you have found a security vulnerability on menozi.com, we encourage you to contact us immediately at contact@menozi.com with the subject line “Security report”. We review all legitimate reports and aim to resolve issues quickly. Before reporting, please review this document – including our fundamentals, reward guidelines and non-reportable issues.

1. Fundamentals

If you follow the principles below when reporting a security issue to Menozi, we will not initiate legal action or enforcement investigations against you in response to your report. We ask that:

• You give us reasonable time to review and fix the issue before disclosing it publicly or sharing it with others.
• You do not interact with or access private accounts without the account owner’s consent.
• You make a good-faith effort to avoid privacy violations, service disruptions or data destruction.
• You do not exploit the issue for any reason, including to demonstrate further risks or access sensitive data.
• You comply with all applicable laws and regulations.

2. Reward program

We recognize and reward security researchers who help protect our store by reporting vulnerabilities. Rewards are awarded at Menozi’s sole discretion, based on risk, impact and report quality. To potentially qualify for a reward, you must:

• Follow the fundamentals listed above.
• Report a valid security bug that poses a risk to privacy or security.
• Submit your report by e-mail to contact@menozi.com – please do not contact employees directly through other channels.
• Disclose any accidental privacy violations or disruptions in your report.
• Understand that while we investigate all valid reports, priority is based on risk, so a response may take some time.
• Agree that we reserve the right to publish submitted reports once fixed.

3. Rewards

Rewards are based on the impact and severity of the vulnerability. Please provide detailed and reproducible steps in your report; if the issue cannot be reproduced, it is not eligible for a reward. The first valid report of an issue receives the reward, and multiple bugs caused by a single underlying issue are treated as one report.

Critical severity – up to $200

• Remote code execution, remote shell or command execution
• Vertical authentication bypass
• SQL injection that leaks targeted data
• Full account takeover

High severity – up to $100

• Lateral authentication bypass
• Disclosure of sensitive internal data
• Stored XSS affecting other users
• Local file inclusion
• Insecure handling of authentication cookies

Medium severity – up to $50

• Logic or business process flaws
• Insecure direct object references

Low severity – recognition only

• Open redirects
• Reflected XSS
• Low-sensitivity information leaks

4. Non-reportable issues

Reports about missing security headers with no demonstrated impact, clickjacking on pages with no sensitive actions, outdated-browser issues, automated scanner output without a proof of concept, or vulnerabilities in third-party services we do not control (for example our payment processor’s own infrastructure) are appreciated but do not qualify for a reward.

5. Contact

Send security reports to contact@menozi.com with the subject line “Security report”. Please include reproduction steps, the affected URL and, where relevant, screenshots.