Bug bounty

We value the work of security researchers. If you believe you've found a vulnerability in ScreenshotDude, please report it to us privately so we can fix it before it is disclosed.

How to report

Email support@screenshotdude.com with the subject "Security report" and include:

• a description of the issue and its impact;
• step-by-step reproduction instructions or a proof of concept;
• affected URLs, endpoints or parameters;
• your name or handle for acknowledgement (optional).

We acknowledge reports within 3 business days and keep you updated until the issue is resolved.

In scope

• the website and dashboard;
• the public API (https://api.screenshotdude.com), including /v1/*, /public/* and /mcp;
• the official SDKs and CLI.

Examples of issues we care about: authentication or authorization bypass, cross-tenant data access, server-side request forgery (SSRF) through the rendering engine, remote code execution, API key leakage, billing bypass, stored XSS.

Out of scope

• denial of service, volumetric or rate-limit testing;
• social engineering and physical attacks;
• reports from automated scanners without a demonstrated impact;
• missing security headers without an exploitable scenario;
• vulnerabilities in third-party services we use (report them to the vendor).

Rules

• Only test against your own account and data. Never access, modify or delete other customers' data.
• Give us reasonable time to fix the issue before any public disclosure.
• Don't degrade the Service for other users.

Rewards

Rewards are discretionary and depend on severity and report quality, ranging from public acknowledgement and free credits to monetary rewards for critical issues. We will not take legal action against researchers acting in good faith under this policy.