Last updated: October 26, 2026
Minut's Bug Bounty Program was paused on April 10, 2025 and will not be resumed. We no longer pay rewards for reported vulnerabilities. Submitting a report does not qualify you for payment or any other compensation.
We still welcome security reports and take every credible report seriously. If you think you have found a vulnerability in a Minut product or service, email vulnreports@minut.com with:
- A description of the issue and its potential impact
- Clear steps to reproduce it, including any proof-of-concept code
- The affected product, app version, URL or endpoint
Please use only this address. Reports sent to support or to individual employees may not be processed.
We follow common industry practice for responsible disclosure. When you research and report an issue, please:
- Act in good faith and avoid privacy violations, data destruction and service disruption
- Access only the data needed to show the issue exists, and never access, change or keep other users' data
- Not run denial-of-service attacks, social engineering, physical attacks or high-volume automated scanning
- Give us reasonable time to investigate and fix the issue before you disclose it publicly, and coordinate the timing with us
We will acknowledge valid reports, investigate them, and work to fix confirmed issues within a reasonable timeframe based on their severity. We may contact you if we need more information.
