irccloud.com
External Program
Submit bugs directly to this organization
External Program
Submit bugs directly to this organization
[/](
IRCCloud
)
This page is intended for security researchers. To find out more about our security, please visit our [/privacy](privacy information) page.
If you believe you have found a security vulnerability on IRCCloud, we encourage you to let us know right away. We will investigate all legitimate reports and do our best to quickly fix the problem.
Please submit your report on https://hackerone.com/irccloud/reports/new and our security team will respond as soon as possible.
If you give us a reasonable time to respond to your report before making any information public and make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you.
To show our appreciation for security researchers, we offer a monetary bounty for certain qualifying security bugs. Here is how it works:
To qualify for a bounty, you must:
Adhere to our Responsible Disclosure Policy (above)
Be the first person to responsibly disclose the bug
Report a bug applicable to our main web application on www.irccloud.com, and not any other subdomains.
Report a bug that could compromise the integrity of our user data, circumvent the privacy protections of our user data, or enable access to a system within our infrastructure, such as:
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF/XSRF)
Broken Authentication
Circumvention of our Privacy policy
Remote Code Execution
Privilege Escalation
Provisioning Errors
Please use a test account instead of a real account when investigating bugs. When you are unable to reproduce a bug with a test account, it is acceptable to use a real account, except for automated testing. Do not interact with other IRC users or channels without the consent of their owners.
Reside in a country not under any current U.S. Sanctions (e.g., North Korea, Libya, Cuba, etc.)
We will assess each bug to determine if it qualifies.
Our minimum reward is $50 USD for minor issues, while we expect to reward $500+ USD for major vulnerabilities
There is no maximum reward: each bug is awarded a bounty based on its severity and creativity
Only 1 bounty per security bug will be awarded
The following bugs are not eligible for a bounty (and we do not recommend testing for these):
Denial of Service Vulnerabilities
Spam or Social Engineering techniques
https://github.com/irccloud/irccloud-tools/wiki/API-Overview /about https://blog.irccloud.com/ /pricing /changelog /faq /jobs
[/terms](Terms of Service) [/privacy](Privacy Policy) [/networks](IP Addresses) [/abuse](Report Abuse)
https://x.com/irccloud https://bsky.app/profile/irccloud.com https://mastodon.social/@irccloud mailto:[email protected]
Apps: https://itunes.apple.com/app/irccloud/id672699103 https://play.google.com/store/apps/details?id=com.irccloud.android
© 2026 IRCCloud Ltd.