Why we ended the paid program
For years we paid rewards for security findings in Storj software and services. We have closed that program for two reasons.
- The volume of AI-generated reports. Most of what we received was produced by automated tools and language models. These reports were often generic, unverified or simply wrong. Triaging them took engineering time away from real security work and buried the few reports that mattered.
- Cost. We could no longer justify the budget for cash rewards against the value the program delivered.
Ending the rewards does not change how seriously we take security. Valid reports still get a fast and careful response.
Responsible disclosure
If you find a vulnerability in Storj, please report it to us privately so we can fix it before it is made public.
How to report
Email security-reports@storj.io with:
- A clear description of the issue and its impact.
- The affected product, endpoint, component or repository and version.
- Step-by-step instructions to reproduce it, with a working proof of concept where possible.
- Your name or handle as you would like it to appear in our credits.
Please write the report yourself and confirm the issue is real before you send it. Reports that are generated by a tool and not verified by a person will be closed without a response.
What we ask of you
- Give us a reasonable amount of time to investigate and fix the issue before you disclose it publicly. We aim for 90 days and will agree on a timeline with you.
- Only test against accounts and data you own. Do not access, change or delete other people's data.
- Do not degrade the service for others. No denial of service, spam or load testing.
- Do not use social engineering, phishing or physical attacks against Storj staff, customers or offices.
- Stop and contact us as soon as you have enough to demonstrate the issue.
What you can expect from us
- An acknowledgement of your report within five business days.
- An assessment of whether we can reproduce the issue and how severe we consider it.
- Updates as we work on a fix and a note when it is released.
- No legal action against you for research that follows these guidelines in good faith.
Out of scope
- Reports from automated scanners without a demonstrated, exploitable impact.
- Missing security headers, cookie flags or email records (SPF, DKIM, DMARC) on their own.
- Clickjacking on pages with no sensitive actions.
- Self-XSS, CSRF on logout and other issues that need an unlikely user interaction.
- Rate limiting, brute force or enumeration findings without a real-world impact.
- Vulnerabilities in third-party services we do not control.
- Issues in outdated browsers or platforms.
Public credit, not cash
We do not pay rewards for security reports. What we can offer is recognition.
With your permission, we will credit you by name or handle in the release notes or security advisory for the fix and on this page. If you would rather stay anonymous, tell us and we will respect that.
Hall of fame
We thank the following researchers for reporting issues responsibly.
No credits yet under the new program.