Skip to content

Effective 24 October 2026 · Version 2026-10-24

Security Disclosure Policy

How to report a security vulnerability in 10k, what we promise in return, and the rules for good-faith security research.

Reporting a vulnerability

If you believe you have found a security vulnerability in 10k, including our website, apps or API, email help@10k.live with “Security” in the subject line.

Please describe the issue, the steps to reproduce it, the affected web address or app version, and the impact you expect. Do not include other people’s personal data. If you came across any, tell us what kind of data it was instead.

What we promise

  • We will confirm that we received your report within 5 working days.
  • We will keep you informed while we investigate, and tell you when the issue is fixed.
  • We will keep your report confidential and will not share your personal details without your permission, unless the law requires it.

Good-faith research

We will not take legal action against you, or ask law enforcement to investigate you, for security research that follows this policy in good faith. Good-faith research means that you:

  • access, copy or keep only the minimum data needed to show the issue;
  • do not change or delete data;
  • use only accounts you own or have permission to use, and never access other people’s accounts or data;
  • stop testing and report to us as soon as you find a vulnerability;
  • do not disrupt or slow down the service for other people;
  • give us reasonable time to fix the issue before you tell anyone else about it.

This policy cannot authorize testing of services that other companies run for us, such as payment, hosting or app store providers. Report issues in those services to the provider.

What is not allowed

  • Denial-of-service, load or stress testing.
  • Automated scanning that sends large volumes of requests.
  • Spam, social engineering or phishing aimed at our team or users.
  • Physical attacks on people, offices or equipment.

No bug bounty

We do not run a bug bounty program and do not pay for reports. We are grateful for every report made in good faith.
Loading 10k