Bug Bounty Program
Tonal rewards security researchers who help us protect our artists, listeners, and the payout ecosystem. Help us keep human-made music safe.
Earn rewards for finding vulnerabilities
We believe transparency and community vigilance are essential to platform integrity. If you discover a security vulnerability, report it responsibly and we'll reward you based on severity. Payouts are made from the platform security fund.
Reward Tiers
RCE, SQL injection, auth bypass, or access to payout system
Privilege escalation, data exposure, or payment manipulation
XSS, CSRF, or logic flaws affecting user data
Information disclosure or minor security issues
Scope
Rules of Engagement
- 1.Only test on production infrastructure at tonal.fm or subdomains.
- 2.Do not access, modify, or delete data belonging to other users.
- 3.Do not use automated scanners that generate excessive traffic.
- 4.Report vulnerabilities within 24 hours of discovery.
- 5.Allow reasonable time for remediation before public disclosure.
- 6.Do not exploit the vulnerability beyond what is necessary to demonstrate it.
How to Report
Send vulnerability details to our security team. Include reproduction steps, impact assessment, and any proof-of-concept. We'll acknowledge receipt within 48 hours and provide a remediation timeline.