Security & Responsible Disclosure

Last updated: 6 June 2026

 We take security seriously. If you've found a vulnerability, please tell us before making it public. We commit to acknowledging all valid reports and fixing confirmed issues promptly. 

How to report a vulnerability

Preferred channel — encrypted email

Email security@chessmovesai.com with:

A clear description of the vulnerability and its impact.
Steps to reproduce or a proof-of-concept (PoC). The simpler, the better.
The URL or endpoint affected.
Your name/handle (for acknowledgement, optional).

For high-sensitivity findings (credential exposure, RCE, SQLi), please encrypt your report using our PGP key at /.well-known/pgp-key.txt.

Response timeline

Acknowledgement: within 2 business days.
Triage & initial assessment: within 5 business days.
Fix or mitigation: within 30 days for critical/high, 90 days for medium/low.
Coordinated disclosure: we'll agree a public disclosure date with you once the fix is deployed.

Scope

In scope

Target	Type
chessflows.com (web app)	XSS, CSRF, SQLi, auth bypass, IDOR, privilege escalation
chessflows.com/api/* (REST API)	Broken access control, injection, information disclosure
WebSocket endpoint (wss://chessflows.com)	Message injection, DoS, auth bypass
Authentication flows	Token forgery, session fixation, account takeover
File upload / media handling	Path traversal, stored XSS, SSRF via upload

Out of scope

Category	Reason
Denial-of-service (volumetric)	Infrastructure/network attacks, not application bugs
Social engineering / phishing	Not a code vulnerability
Physical access attacks	Out of scope
Third-party services (Stripe, Anthropic, Lichess)	Report directly to those vendors
Automated scanner output without PoC	Low signal without evidence of exploitability
Missing security headers on non-sensitive pages	Not reportable without exploit
Self-XSS (requires tricking yourself)	No practical impact
Outdated TLS versions without downgrade PoC	Low practical risk

Rules of engagement

Please follow these rules. Violating them may result in legal action even if your finding is valid.

Do not access or modify other users' data. Use test accounts you own.
Do not perform DoS or DDoS attacks against any ChessMoves AI infrastructure.
Do not automate scanner requests at a rate that degrades service for real users.
Do not exfiltrate data beyond the minimum needed to demonstrate the vulnerability.
Do not disclose publicly until we have confirmed a fix or 90 days have elapsed (whichever comes first).
Do not test in production if you can replicate the issue in a test environment.

Rewards & recognition

ChessMoves AI does not currently operate a paid bug bounty programme. However, we offer:

Public acknowledgement in the Hall of Fame below (with your permission).
1 year free Premium subscription for confirmed critical or high severity findings.
3 months free Premium subscription for confirmed medium severity findings.

Severity classification

Severity	Examples
Critical	RCE, SQLi with data exfil, full account takeover without user interaction
High	IDOR exposing private data, stored XSS, auth bypass, mass account enumeration
Medium	Reflected XSS, CSRF, rate limit bypass on sensitive endpoints
Low	Information disclosure (non-sensitive), open redirect, minor config issue

Safe harbour

ChessMoves AI will not pursue legal action against researchers who:

Follow the rules of engagement above.
Report findings to us before public disclosure.
Do not cause harm to users or to the platform.

We consider good-faith security research conducted under this policy to be authorised access. We will not file complaints with law enforcement for activity within these rules.

Hall of fame

We are grateful to the following researchers who have responsibly disclosed vulnerabilities to us:

—Be the first!

Machine-readable disclosure policy: /.well-known/security.txt