Responsible Disclosure & Bug Bounty

• wallies.base44.app and Wallies mobile apps
• Authentication, authorization, and data-access flaws
• ILY ledger, payout, and purchase logic
• Upload, media-signing, and moderation bypasses

• Third-party services (Stripe, Mux, Bunny, AI providers) — report to them directly
• Social engineering, phishing, or physical attacks
• Denial-of-service or load testing
• Missing best-practice headers without a demonstrated exploit
• AI jailbreak outputs (report via the in-app safety report instead)

• Use only your own accounts; never access, modify, or delete other users' data
• Stop and report as soon as you confirm a vulnerability
• Do not exploit financial bugs beyond minimal proof
• Keep findings confidential until we confirm a fix

Research conducted in good faith under this policy is authorized. Wallies LLC will not pursue legal action or report you to law enforcement for such research, and will not treat it as a violation of the Terms of Service. If a third party brings action, we will make it known that your activity was authorized.

Rewards are discretionary; the first valid report of an issue is rewarded. Bounty ILY counts as eligible earnings and accumulates toward the 35,000 ILY withdrawal threshold described in the ILY Economy Policy. Exceptional critical findings may be considered for an additional reward outside these ranges.

Use the in-app bug report (Settings → Support) or email security@wallies.com with steps to reproduce. We acknowledge within 3 business days.