Report a vulnerability
Found a security issue in the DualGuard platform? Email security@dualguard.xyz with enough detail to reproduce it. We would rather hear about it from you than find out another way.
Found something in a protocol we reviewed?
That does not belong here. A finding in a client’s code belongs in the contest or bug bounty covering it, submitted on the platform, where it is timestamped, judged and paid. Sending it to this address instead puts it outside the programme and can cost you the reward. How our bug bounties work.
What is in scope
The DualGuard platform: the application our guards, judges and protocol teams sign in to, and the code behind it. Anything that lets someone read data they should not, act as another person, take over an account, or change what a contest records.
What is not
Client protocols, as above. This marketing site, dualguard.xyz, which holds no accounts and no contest data. Findings from automated scanners with no demonstrated impact. Missing headers or best-practice warnings that do not lead anywhere. Reports that require an attacker to already control the victim’s machine or browser. Volumetric denial of service.
Do not test in a way that degrades the service for anyone else, and do not access, change or keep data that is not yours. If a proof of concept needs either, describe what you would do instead of doing it.
What to send
Where it is, what an attacker gets, and the steps to reproduce it. A short proof of concept beats a long description. Tell us how you would like to be credited, and whether you plan to write it up.
What happens next
We aim to acknowledge a report within two working days, and to tell you what we intend to do about it once we have reproduced it. We will keep you updated until it is closed, and we are happy to credit you publicly when it is.
What we reward
We start accepting submissions on 7 November 2026, for findings in the DualGuard platform.
Only medium and high severity issues are rewarded, the same bar we apply to our own contests. Lows and informational findings are welcome and we will fix what deserves fixing, but they do not carry a reward.
A medium gets you a DualGuard sweatshirt, with your profile picture and username printed on the back. A high gets you the sweatshirt and $100. We will ask for the picture and the handle you want on it once the finding is confirmed.
Rewarded means in scope, reproducible, and something we end up fixing, the same bar the rest of this page describes.