BeHappyTalk's top priority is security. If you believe you've found a security bug in our in-scope applications or infrastructure, we are happy to work with you to resolve the issue promptly and ensure you are fairly rewarded for your discovery.
Submit bugs to us at Care@BeHappyTalk.com, along with a detailed description of the issue and steps to reproduce it.
Your participation in our Report Vulnerability Program is voluntary. By participating in our Report Vulnerability Program, submitting a report or otherwise disclosing a vulnerability to us ("Submission"), you are indicating that you have read and agree to follow the rules set forth on this page ("Program Terms").
Confidentiality
Any information you receive, collect or otherwise obtain about us, our services, our affiliates or any of our members, employees or agents, in connection with our Report Vulnerability Program ("Confidential Information") must be kept confidential, only used in connection with the Report Vulnerability Program and not disclosed to any third party.
Once a Submission is made, BeHappyTalk reserves the right to request from you, and you already accept to abide by this request, to securely and irreversibly delete any data related to such Submission.
Eligibility
To participate in our Report Vulnerability Program, you must:
- Be at least 18 years of age if you test using a BeHappyTalk account.
- Not be a resident of a country against which India has issued export sanctions or other trade restrictions.
- Not be in violation of any national, state, or local law or regulation with respect to any activities directly or indirectly related to our Report Vulnerability Program.
- Not be employed by BeHappyTalk or any of its affiliates.
- You are responsible for any tax implications of a reward from our Report Vulnerability Program.
Program Ground Rules
- Don't mass create accounts to perform testing against our applications and services.
- No destructive automated testing — under no circumstance should automated testing cause intentional damage to BeHappyTalk's systems.
- Don't engage in social engineering (e.g. phishing, vishing, smishing).
- Don't attempt to extort us.
- Don't leave any system in a more vulnerable state than you found it.
- Don't publicly disclose vulnerabilities without our explicit consent.
- Do respect our members' privacy.
- Do research vulnerabilities and disclose vulnerabilities to us in good faith.
- Don't leak, manipulate, or destroy any user data. Please only test against accounts you own yourself or with explicit permission of the account holder.
Bounty Eligibility
To qualify for a reward under this program, you must:
- Send a clear textual vulnerability description of the bug along with the steps to reproduce the vulnerability.
- Include attachments such as screenshots and proof of concept code as necessary.
- Be the first to report a specific vulnerability.
- Disclose the vulnerability report directly and exclusively to us.
- Stay in scope — do not attempt to elevate privileges beyond the minimum necessary to prove access.
Rewards
BeHappyTalk recognizes and rewards security researchers who help us keep people safe by reporting vulnerabilities in our services.
- Monetary bounties for such reports are entirely and solely at BeHappyTalk's discretion, based on risk, impact, and other factors.
- We investigate all valid reports. In case found qualified, we award a bounty to the first person to submit an issue.
- If we pay a bounty, the minimum reward is 1000 INR. Note that extremely low-risk issues may not qualify for a bounty at all.
Thank you for doing your part in keeping the BeHappyTalk community safe! Contact us at care@BeHappyTalk.com