Kurodyne is a marketplace for digital products, such as software, agent skills, and templates. Many are code that buyers run, so what matters most is that every package a buyer receives is exactly the one a reviewer approved.

In Scope

• kurodyne.com: The web app, its APIs and OAuth endpoints, and image transformation routes
• mcp.kurodyne.com: The Catalog, Seller, and Admin MCP servers
• Supabase: Kurodyne's access policies, database functions, Auth configuration, and Storage rules in the project the web app calls
• Admin surfaces: Only through privilege escalation from a non-admin account you own

Only these assets are in scope.

Out of Scope

• status.kurodyne.com and bounce.kurodyne.com, except subdomain takeover through Kurodyne's DNS records
• kurodyne.com/api/debug and kurodyne.com/api/health
• Third-party platforms, such as Stripe, Supabase, Cloudflare, DigitalOcean, Google, and AI providers, except Kurodyne's configuration of them
• Products sold on Kurodyne, and sellers' own websites and software

Priority Findings

• Publishing or changing a listing, release, or package without approval
• Account takeover, or access-control failures in the app, Supabase policies, MCP grants, or OAuth scopes
• Getting a paid package or product key without entitlement, underpaying at checkout, or redirecting seller proceeds
• Reading other users' messages in Kurodyne Relay (buyer-seller messaging), impersonating another user, starting a conversation as a seller (sellers can only reply), or sending an attachment other than a JPG or PNG image
• Server-side code execution, SSRF, stored XSS, or unsafe upload handling
• Prompt injection that makes Operator (the AI assistant) expose another user's private data or take an unauthorized action

Ineligible Findings

Reports must demonstrate security impact. These findings are ineligible:

• Header, cookie, CSP, or email configuration issues without a working exploit
• Software version or origin IP disclosure
• Data and keys that are public by design, such as the Supabase publishable key
• Account, username, or email enumeration
• Self-XSS, and CSRF, clickjacking, or open redirects without security impact
• Missing rate limits, unless they enable account takeover or material cost to Kurodyne
• Scanner output, and dependency vulnerabilities without a working exploit against Kurodyne
• Issues that affect only outdated browsers or clients
• Denial of service and resource exhaustion
• Malware-scanner evasion, reviewer deception, and social engineering
• Operator output that exposes no private data and takes no unauthorized action

Testing Rules

• Use only accounts, Stripe accounts, and payment methods you own, and interact only with your own accounts. Start every test username with security_.
• Use the minimum access or change needed to prove an issue. If you reach another user's data, stop, do not keep or share it, and report it immediately.
• Do not contact users or staff outside Bugbop, test credentials you do not own, upload malware or malware test files, open payment disputes, run automated scanners, or test availability.
• Limit scripted traffic to 10 requests per minute, sign-in attempts to 10 per hour, and emails you trigger to 5 per hour.
• Ask through Bugbop before testing a race condition, completing a purchase, submitting a listing for review, or running any test these rules do not clearly allow.
• Keep findings confidential until Kurodyne fixes them and approves disclosure in writing.

Rewards

Kurodyne sets severity from demonstrated impact, not the vulnerability type or CVSS score.

• Critical: Server or admin compromise, account takeover, access to many users' private data, or a full bypass of publication review, package integrity, payment, or entitlement controls
• High: Access to one user's private data, or a partial bypass of review, authentication, Kurodyne Relay, MCP, OAuth, or payment controls
• Medium: Limited confidentiality or integrity impact under realistic conditions
• Low: A valid issue with little practical impact, eligible for public credit but no cash reward

Each root cause earns one reward, for its first valid report, and a chain earns one reward at the severity of its final impact. Kurodyne decides validity and severity, and Bugbop's payout and eligibility requirements apply.

Reporting and Response

Submit one root cause per report, with the affected asset, reproduction steps, evidence, the impact you demonstrated, and your test usernames. AI-assisted research is welcome, but report only findings you reproduced yourself against Kurodyne.

We acknowledge reports within 3 business days and give an initial validity and severity decision within 10 business days. We keep you updated on accepted reports and, with your permission, credit you after the fix ships.

Safe Harbor

Kurodyne authorizes good-faith research that follows this program. We will not initiate or support civil or criminal action against you for that research under the Computer Fraud and Abuse Act, section 1201 of the Digital Millennium Copyright Act, or similar laws. We also waive any Terms of Use restriction that would otherwise prohibit that research.

If a third party brings legal action over compliant research, we will confirm that it was authorized. This authorization covers only Kurodyne's systems and cannot bind a third party.