Security

How to report

Email hello@radius.to with the subject line Security report. Please include enough detail for us to reproduce the issue.

What to include

• A clear description of the vulnerability (e.g. XSS, IDOR, authentication bypass).
• The affected URL, endpoint, or feature.
• Step-by-step reproduction instructions.
• The potential impact (what an attacker could do).
• Optional: screenshots or a minimal proof of concept.

What you can expect from us

• We aim to acknowledge reports within a few business days.
• We will investigate in good faith and work to fix confirmed issues.
• We will keep you updated if you would like follow-up on a fix.
• With your permission, we are happy to credit you on this page or in release notes.

Recognition and thank-you payments

We do not run a formal bug bounty program and cannot guarantee payment for every report. As a small, pre-revenue project our budget is limited.

For valid, previously unknown issues we may offer a discretionary thank-you payment at our sole discretion, depending on severity and impact. As a rough guide:

• Critical issues (e.g. account takeover, broad data exposure, authentication bypass): eligible for our highest discretionary payments.
• Meaningful but lower-severity issues (e.g. limited IDOR, stored XSS with narrow impact): eligible for a smaller discretionary payment.

Any payment is guideline-based and decided case by case, not a promise or contract. Duplicate reports, issues we already knew about, and out-of-scope findings are not eligible.

Scope

In scope: the radius.to web application, authenticated user features, and our authenticated API where you hold a legitimate API key for testing.

Out of scope: social engineering, physical attacks, denial-of-service, spam or rate-limit noise without a demonstrated exploit, vulnerabilities in third-party services (e.g. Stripe, Google OAuth), and issues requiring unlikely user interaction with no meaningful security impact.

Safe harbour

If you report a vulnerability in good faith, follow this policy, avoid accessing or exfiltrating other users' data beyond what is necessary to demonstrate the issue, and do not disrupt the service, we will not pursue legal action against you for that research.