<spanclass=toggle-dark><svgxmlns="http://www.w3.org/2000/svg"width="20"height="20"viewBox="0 0 24 24"fill="none"stroke="currentcolor"stroke-width="2"stroke-linecap="round"stroke-linejoin="round"class="feather feather-moon"><pathd="M21 12.79A9 9 0 1111.21 3 7 7 0 0021 12.79z"/></svg></span><spanclass=toggle-light><svgxmlns="http://www.w3.org/2000/svg"width="20"height="20"viewBox="0 0 24 24"fill="none"stroke="currentcolor"stroke-width="2"stroke-linecap="round"stroke-linejoin="round"class="feather feather-sun"><circlecx="12"cy="12"r="5"/><linex1="12"y1="1"x2="12"y2="3"/><linex1="12"y1="21"x2="12"y2="23"/><linex1="4.22"y1="4.22"x2="5.64"y2="5.64"/><linex1="18.36"y1="18.36"x2="19.78"y2="19.78"/><linex1="1"y1="12"x2="3"y2="12"/><linex1="21"y1="12"x2="23"y2="12"/><linex1="4.22"y1="19.78"x2="5.64"y2="18.36"/><linex1="18.36"y1="5.64"x2="19.78"y2="4.22"/></svg></span></button><ulclass="navbar-nav social-nav order-3 order-md-5"><liclass=nav-item><aclass=nav-linkhref=https://github.com/mCaptcha><svgxmlns="http://www.w3.org/2000/svg"width="20"height="20"viewBox="0 0 24 24"fill="none"stroke="currentcolor"stroke-width="2"stroke-linecap="round"stroke-linejoin="round"class="feather feather-github"><pathd="M9 19c-5 1.5-5-2.5-7-3m14 6v-3.87a3.37 3.37.0 00-.94-2.61c3.14-.35 6.44-1.54 6.44-7A5.44 5.44.0 0020 4.77 5.07 5.07.0 0019.91 1S18.73.65 16 2.48a13.38 13.38.0 00-7 0C6.27.65 5.09 1 5.09 1A5.07 5.07.0 005 4.77 5.44 5.44.0 003.5 8.55c0 5.42 3.3 6.61 6.44 7A3.37 3.37.0 009 18.13V22"/></svg><spanclass="ms-2 visually-hidden">GitHub</span></a></li></ul><divclass="collapse navbar-collapse order-4 order-md-1"><ulclass="navbar-nav main-nav me-auto order-5 order-md-2"><liclass=nav-item><aclass=nav-linkhref=/blog/>Blog</a></li><liclass=nav-item><aclass=nav-linkhref=/community/>Community</a></li><liclass=nav-item><aclass=nav-linkhref=/contact/>Contact</a></li><liclass=nav-item><aclass=nav-linkhref=/about/>About</a></li><liclass=nav-item><aclass=nav-linkhref=/docs/webmasters/installing-captcha/>Docs</a></li></ul><divclass="break order-6 d-md-none"></div><formclass="navbar-form flex-grow-1 order-7 order-md-3"><inputid=userinputclass="form-control is-search"type=searchplaceholder="Search docs..."aria-label="Search docs..."autocomplete=off><divid=suggestionsclass="shadow bg-white rounded"></div></form></div></div></header><divclass="wrap container"role=document><divclass=content><divclass="row flex-xl-nowrap"><navclass="docs-toc d-none d-xl-block col-xl-3"aria-label="Secondary navigation"><divclass=page-links><h3>On this page</h3><navid=TableOfContents><ul><li><ahref=#rules>Rules:</a><ul><li><ahref=#before-you-start>Before you start</a></li><li><ahref=#performing-your-research>Performing your research</a></li><li><ahref=#handling-personally-identifiable-information-pii>Handling personally identifiable information (PII)</a></li><li><ahref=#reporting-your-vulnerability>Reporting your vulnerability</a></li><li><ahref=#legal-safe-harbor>Legal safe harbor:</a></li></ul></li><li><ahref=#scope>Scope:</a><ul><li><ahref=#mcaptchaorg>mcaptcha.org</a></li><li><ahref=#mcaptchaio>mcaptcha.io</a></li></ul></li><li><ahref=#contact>Contact</a><ul><li><ahref=#email>Email</a></li><li><ahref=#gpg-key>GPG Key</a></li></ul></li></ul></nav></div></nav><mainclass="docs-content col-lg-11 col-xl-9"><h1>Security</h1><p><small>Last Edited May 27, 2021</small><p><pclass=lead></p><p>Security is at the heart of mCaptcha. If you find any discrepancies in
our software(see listing on our <ahref=https://github.com/mCaptcha>GitHub</a>,
<ahref=#scope>services available</a>)</p><h2id=rules>Rules:<ahref=#rulesclass=anchoraria-hidden=true>#</a></h2><h3id=before-you-start>Before you start<ahref=#before-you-startclass=anchoraria-hidden=true>#</a></h3><ul><li><p>Check the list of domains that are in scope for security research
and the list of targets for useful information for getting started.</p></li><li><p>Check the list of bugs that have been classified as ineligible.</p></li><li><p>Check our changelog(in our GitHub repositories) for recently launched
features.</p></li><li><p>Never attempt non-technical attacks such as social engineering,
infrastructure.</p></li></ul><p>When in doubt, contact
me(<ahref=/contributors/aravinth-manivannan/>@realaravinth</a>) at
<ahref=mailto:realaravinth@batsense.net>realaravinth@batense.net</a>.</p><h3id=performing-your-research>Performing your research<ahref=#performing-your-researchclass=anchoraria-hidden=true>#</a></h3><ul><li><p>Do not impact other users with your testing, this includes testing
requests in two minutes using Burp Suite Intruder is excessive.</p></li></ul></li><li><p>Researching denial-of-service attacks is allowed only if you follow
these rules:</p><ul><li><p>There are no limits for researching denial of service
service issues.</strong></p></li><li><p>If you choose to test on mCaptcha proper (i.e.
<ahref=https://mcaptcha.org>https://mcaptcha.org</a> or <ahref=https://mcaptcha.io>https://mcaptcha.io</a>):</p><ul><li>Research must be performed using credentials you own.</li><li>Stop immediately if you believe you have affected the
will be able to determine the impact.</li></ul></li></ul></li></ul><h3id=handling-personally-identifiable-information-pii>Handling personally identifiable information (PII)<ahref=#handling-personally-identifiable-information-piiclass=anchoraria-hidden=true>#</a></h3><ul><li><p>Personally identifying information (PII) includes:</p><ul><li>legal and/or full names</li><li>names or usernames combined with other identifiers like phone numbers or email addresses</li><li>health or financial information (including insurance information, social security numbers, etc.)</li><li>information about political or religious affiliations</li><li>information about race, ethnicity, sexual orientation, gender, or other identifying information that could be used for discriminatory purposes</li></ul></li><li><p>Do not intentionally access others’ PII. If you suspect a service
information.</p></li><li><p>Report the vulnerability immediately and do not attempt to access any
other data. We will assess the scope and impact of the PII exposure.</p></li><li><p>Limit the amount of data returned from services. For SQL injection,
for example, limit the number of rows returned</p></li><li><p>You must delete all your local, stored, or cached copies of data
vulnerability.</p></li></ul><h3id=reporting-your-vulnerability>Reporting your vulnerability<ahref=#reporting-your-vulnerabilityclass=anchoraria-hidden=true>#</a></h3><ul><li><p>Reports must include written instructions for reproducing the
vulnerability.</p></li><li><p>When reporting vulnerabilities you must keep all information on
restricted to email correspondence with us(<ahref=#contact>see below for
been publicly made available.</p></li></ul><h3id=legal-safe-harbor>Legal safe harbor:<ahref=#legal-safe-harborclass=anchoraria-hidden=true>#</a></h3><p>We currently don’t have any legal policies in place but rest assured
“authorized”.</p><p>A detailed policy based on this sentiment is in the works.</p><h2id=scope>Scope:<ahref=#scopeclass=anchoraria-hidden=true>#</a></h2><p>mCaptcha runs a number of services. Only domains listed below are are
below are <em>not</em> in scope and are <em>not</em> covered by our <ahref=./#legal-safe-harbor>legal safe
harbor</a></p><h3id=mcaptchaorg>mcaptcha.org<ahref=#mcaptchaorgclass=anchoraria-hidden=true>#</a></h3><ul><li>mcaptcha.org</li><li>demo.mcaptcha.org</li><li>demo2.mcaptcha.org</li></ul><h3id=mcaptchaio>mcaptcha.io<ahref=#mcaptchaioclass=anchoraria-hidden=true>#</a></h3><ul><li>mcaptcha.io</li></ul><h2id=contact>Contact<ahref=#contactclass=anchoraria-hidden=true>#</a></h2><h3id=email>Email<ahref=#emailclass=anchoraria-hidden=true>#</a></h3><p><ahref=mailto:realaravinth@batsense.net>realaravinth@batense.net</a>.</p><h3id=gpg-key>GPG Key<ahref=#gpg-keyclass=anchoraria-hidden=true>#</a></h3><p><ahref=/aravinth.asc>Click here to download key</a></p><pre><codeclass=language-GPGdata-lang=GPG>-----BEGIN PGP PUBLIC KEY BLOCK-----
