Security & Bug Bounty

1. Encryption and Network Communication Standards

All data moving between web browsers, mobile clients, and Distdel servers is encrypted in transit using Transport Layer Security (TLS 1.2 and TLS 1.3) protocols. We enforce HTTP Strict Transport Security (HSTS) across all endpoints to prevent downgrade attacks.

Sensitive user credentials, payout banking account details, identity documents, and tax registration strings are encrypted at rest using AES-256 cryptographic standards. Passwords are never stored as plain text; instead, we compile secure hashes using salt-strengthened bcrypt algorithms.

2. Infrastructure and Access Controls

Our web servers, API layers, and databases are hosted on enterprise-grade cloud environments configured within segmented Virtual Private Clouds (VPCs).

• Rate-Limiting & WAF: We employ Web Application Firewalls (WAF) to filter malicious requests, deflect automated scripting, and prevent Distributed Denial of Service (DDoS) attempts.
• Database Protections: Direct database access is strictly isolated. Database records are reachable only by authorized server functions. Administrative console logins require Multi-Factor Authentication (MFA).
• Session Lifecycle: Authentication sessions (NextAuth) expire automatically after preset durations. We validate CSRF headers on all mutate APIs to block session hijacks.

3. Ethical Vulnerability Disclosure & Bug Bounty Program

We welcome collaboration with white-hat security researchers. If you identify a security defect, memory leak, authorization bypass, or potential vulnerability in our codebase or API endpoints, please alert us at distdel.dev@gmail.com.

Vulnerability Classifications & Rewards:

• Critical Severity (Remote Code Execution, Database SQL Injection): Eligible for high-tier rewards.
• High Severity (Authorization Bypass, Account Takeover, Payout Redirection): Eligible for medium-tier rewards.
• Medium Severity (Cross-Site Scripting, Sensitive Data Leak, IDOR): Eligible for standard rewards.

Safe Harbor Policy: Researchers must not disrupt live users, execute DDoS attacks, or copy private client records. Ethical research conducted within these boundaries is fully protected, and we will not pursue legal actions against participants.