Security Reporting

Website or account vulnerability

Signed-in members should use the private Report a Bug workflow for suspected vulnerabilities in Code Card itself. Clearly mark the report as a security issue and include the affected route or feature, reproduction steps, expected impact, and any relevant browser or environment information.

Unsafe Code Card

If the issue is a specific published Code Card rather than the website itself, use the card's Report action and select Security or unsafe code.

Responsible testing

• Do not attempt to access another user's private content or account.
• Do not run denial-of-service, destructive, persistence, malware, or social-engineering tests against production.
• Do not retain or publish private data discovered accidentally.
• Do not include passwords, session cookies, reset links, API secrets, or other live credentials in a report.
• Stop testing if continued activity could damage data, disrupt service, or affect another user.

What happens to a report

Private bug reports can receive staff replies and status updates. Security-related Code Card reports enter the moderation queue. Administrative and moderation actions are recorded in the site's audit systems.

Security operations

Code Card uses layered controls including HTTPS, request-origin protections, application rate limits, edge filtering, production monitoring, restricted database exposure, encrypted off-server backups, and recovery testing. These controls reduce risk but do not make any internet service invulnerable.

Bug bounty

Code Card does not currently operate a paid bug-bounty program. Do not assume testing authorization beyond the good-faith, non-disruptive reporting guidance on this page.