Help us keep PropFirmMatch secure

Bug Bounty Program

At PropFirmMatch.com, we are committed to maintaining a secure and private platform. We encourage ethical hackers and researchers to report security vulnerabilities responsibly. Your contributions help us safeguard our community.

Learn More
Protect the Community
Protect the Community

Make the platform safer for everyone.

Earn Your Spot
Earn Your Spot

Gain recognition in our Hall of Fame.

Get Rewarded
Get Rewarded

Score exclusive swag and, in rare cases, monetary rewards.

Security Through Transparency

Report a Vulnerability

Program Rules

To ensure ethical and productive collaboration, please follow these rules:

  • Be the first to report the issue
  • Focus on in-scope assets owned by PropFirmMatch
  • Never access, modify, or store user data
  • No public disclosure before we close the report
  • Use automated tools responsibly
  • Always comply with applicable laws

Recognition & Rewards

We value every valid report and offer the following forms of appreciation:

Hall of Fame

Public credit for your contribution.

Exclusive Swag

Custom PropFirmMatch gear for impactful submissions.

Monetary Rewards

Discretionary payouts for rare, critical vulnerabilities.

Reward decisions are final and based on severity, reproducibility, and report quality.

Service-Level Agreement

We aim to keep communication clear and timely:

First Response

Within 2 business days.

Time to Triage

Within 10 business days

Time to Recognition

Within 14 business days

Time to Resolution

Varies based on complexity and severity

Engagement

Your research must prioritize safety and respect:

  • Use test accounts only.
  • Do not exploit vulnerabilities beyond what's necessary.
  • Avoid DoS, brute-force, or spam attacks.
  • No phishing or social engineering, especially targeting staff.

Out-of-Scope Vulnerabilities

These issues are not eligible for rewards or recognition:

  • Requires physical access.
  • Involves outdated/unpatched browsers.
  • Cosmetic UI issues (e.g., misalignments).
  • Clickjacking on non-sensitive/static pages.
  • Missing headers without exploitability.
  • Vulnerabilities in third-party software.
  • Rate limit/caching glitches (like view/like counts).
  • CSRF without proven exploit.
  • Broken links/redirects without security impact.
  • Unvalidated automated tool reports.

Disclosure Policy

We aim to keep communication clear and timely:

  • Informative reports are not disclosed.
  • With your permission, high-impact discoveries may be featured in community updates or blog posts.
twitter-logoinstagram-logoyoutube-logotiktok-logolinkedin-logo

© 2026 Prop Firm Match. All rights reserved.