Security & Bug Bounty

Responsible disclosure · Safe harbor for good-faith research

SherpaCarta practices extreme privacy by design. We welcome security researchers who help us keep the charter and site safe for everyone.

Report a vulnerability

Email: hello@giveabit.io

Include: description, reproduction steps, impact assessment, and your preferred disclosure timeline.

Good-faith security research that follows this policy will not face legal action from Give A Bit, provided you:

In scope:

Out of scope: Third-party CDNs, social engineering, physical attacks, spam.

Critical (RCE, fund theft, mass data leak)Recognition + priority fix + public thanks

High (XSS, auth bypass, signature forgery)Recognition + public thanks

Medium (CSRF, info disclosure)Hall of fame acknowledgment

Low (minor issues, best practices)Acknowledgment

SherpaCarta is a volunteer-funded movement. Rewards are recognition-based until a formal bounty fund is established.

No public reports yet. Be the first to help protect digital rights for 8 billion people.