Security, with care.

Report a vulnerability

Email security@trypharos.app. We aim to acknowledge reports within 72 hours. This is an acknowledgement commitment, not a promised resolution time.

Include the affected version, a description of the issue, safe steps to reproduce it and the potential impact. If possible, use a local demonstration or an archived screenshot.

Keep the report safe

Please don’t include API keys, alpha tokens, passwords or other people’s personal data. Redact screenshots and logs before sharing them. Contact us first if sensitive evidence needs a secure transfer method.

Test only systems and accounts you own or have permission to assess. Avoid accessing others’ data, disrupting services or running real attacks against users.

What happens next

We’ll assess the report, ask for clarification if needed and coordinate a fix and disclosure timeline with you. Please give us a reasonable opportunity to investigate before publishing details that could put users at risk.

The closed alpha does not currently offer a paid bug bounty. This page does not grant permission to test third-party services.

A suspicious page or wrong verdict?

Use Report a wrong verdict in the Pharos popup, or contact support@trypharos.app. Don’t revisit a dangerous page just to collect evidence.