Security & Bug Bounty

Responsible disclosure · Safe harbor for good-faith research

SherpaCarta practices extreme privacy by design. We welcome security researchers who help us keep the charter and site safe for everyone.

Security model

See the repository threat model for assets, trust boundaries, controls, and residual risks. This page describes responsible disclosure; it is not a security certification.

Report a vulnerability

Email: [email protected]

Include: description, reproduction steps, impact assessment, and your preferred disclosure timeline.

Safe harbor

Good-faith security research that follows this policy will not face legal action from Give A Bit, provided you:

Do not access data belonging to other users
Do not perform denial-of-service attacks
Give us reasonable time to fix before public disclosure
Do not exploit findings beyond proof-of-concept

Scope

In scope:

sherpacarta.org and all subpaths
github.com/kitsboy/sherpacarta
Public API at /api/v1/*
MCP server package @giveabit/sherpacarta-mcp

Out of scope: Third-party CDNs, social engineering, physical attacks, spam.

Reward tiers

Critical (RCE, fund theft, mass data leak)Recognition + priority fix + public thanks

High (XSS, auth bypass, signature forgery)Recognition + public thanks

Medium (CSRF, info disclosure)Hall of fame acknowledgment

Low (minor issues, best practices)Acknowledgment

SherpaCarta is a volunteer-funded movement. Rewards are recognition-based until a formal bounty fund is established.

Disclosure timeline

Report to [email protected]
Acknowledgment within 5 business days
Fix timeline based on severity
Coordinated public disclosure with reporter

Hall of fame

No public reports yet. Be the first to help protect digital rights for 8 billion people.

Also see security.txt · Treasury