Skip to main content
AwardKit
Security

Security & Responsible Disclosure

We take the security of AwardKit and our customers' programs seriously. If you have found a vulnerability, here is how to report it and what to expect.

How we protect your data

Program managers trust us with their entrants' data. Here are the safeguards built into AwardKit.

Account security

Passwords are hashed and never stored in plain text. The password policy follows NIST SP 800-63B: at least 15 characters, any characters allowed with no required mix, no forced periodic changes, and every new password is checked against passwords known from data breaches before it is accepted. Email verification is required, two-factor authentication is available, and sensitive endpoints are rate-limited against brute-force attempts.

Encryption

All traffic is encrypted in transit over HTTPS/TLS, and your data is encrypted at rest in our cloud infrastructure.

Payments

Payments are processed by Stripe, a PCI-DSS Level 1 provider. AwardKit never sees or stores your full card number.

Application safeguards

Secure, HTTP-only session cookies and CSRF protection on authenticated actions. Each organization and program is access-scoped to its authorized members.

For how we collect, use, and let you control your data, see our Privacy Policy. For processing on your behalf, including the EU Standard Contractual Clauses, see our Data Processing Agreement.

Where your data lives

All customer data is stored in the United States. Requests and cached public images are handled at the network location nearest the visitor, and Google and Stripe process data on their own infrastructure. We rely on a small set of trusted infrastructure providers to run AwardKit. Each one only receives the data needed to deliver its part of the service.

  • VercelApplication hosting and delivery
  • NeonManaged PostgreSQL database
  • Cloudflare R2File storage kept in the United States by Cloudflare's US jurisdiction guarantee; public images are cached at edge locations near the visitor
  • StripePayments (PCI-DSS Level 1)
  • ResendTransactional email delivery
  • PostHogProduct analytics
  • SentryError monitoring
  • MuxVideo upload, storage and streaming
  • GoogleSign in with Google; Gemini API at program setup only

Our commitments

Beyond the technical safeguards, here is how we operate.

You can delete your data at any time

Delete any entry or any program from your dashboard, or your account from your settings. Database records, uploaded files and videos are removed from our active systems immediately. The database's point-in-time history rolls off after seven days, after which deleted data is no longer recoverable.

Limited internal access

Access to production systems and customer data is restricted to authorized personnel, logged, and used only to support customers or investigate incidents.

Incident notification

If a security incident affects your data, we will notify affected customers without undue delay.

Published uptime

Availability is monitored externally every 3 minutes: the website, sign-in, program pages, and a health check that confirms the database answers. Our target is 99.9% uptime.

View uptime history

Report a vulnerability

Email our security team directly with the details below. This is a dedicated channel for security reports, not a general support inbox.

security@awardkit.io

What to include in a report

We cannot act on vague reports. The more of this you provide, the faster we can validate and fix the issue.

Affected target

The exact URL or endpoint where the issue occurs.

Reproduction

Clear, step-by-step instructions to reproduce it.

Impact

What an attacker could actually do by exploiting it.

Evidence

Proof of concept, screenshots, or sample requests.

In scope

  • Authentication and authorization flaws
  • Injection, remote code execution, or data exposure
  • Issues that let one user access another user or program data
  • Cross-site scripting that executes in another user’s browser
  • Business logic flaws that affect voting, judging results, or payments
  • Vulnerabilities in our web application at awardkit.io

Out of scope

  • Reports with no demonstrated impact or reproduction steps
  • Automated scanner output without a verified, exploitable finding
  • Missing security headers or cookie flags with no concrete exploit
  • Missing DNS or email best-practice records such as SPF, DKIM, DMARC, CAA, MTA-STS, or DNSSEC
  • Hyperlink injection or content spoofing in emails caused by mail-client auto-linking
  • External links or formatting in fields designed for user content, such as program descriptions and submissions, where markdown is a supported feature
  • Ability to sign up with disposable or temporary email addresses
  • Email or account enumeration without demonstrated impact
  • Self-XSS and other issues that require a victim to attack themselves
  • Clickjacking on pages with no sensitive state-changing actions
  • Open redirects, missing rate limits, or password policy preferences without demonstrated impact
  • Reverse tabnabbing, logout CSRF, or CSRF on forms with no sensitive actions
  • CSV or formula injection in exported files opened in spreadsheet applications
  • Vulnerabilities in third-party services we rely on; please report these directly to the affected provider
  • Software version disclosure, stack traces, or outdated libraries without a working exploit
  • Issues requiring man-in-the-middle attacks or physical access to a victim’s device, including post-logout back-button cache behavior
  • Denial-of-service, volume testing, social engineering, or physical attacks

Responsible disclosure

Please give us a reasonable amount of time to investigate and address an issue before any public disclosure. Do not access, modify, or delete data that is not yours, and do not run denial-of-service, high-volume, or other destructive testing against our systems. Keep any test data you create to the minimum needed to demonstrate an issue. Acting in good faith under this policy means we will not pursue legal action related to your research.

AwardKit does not operate a paid bug bounty program and does not offer monetary rewards for vulnerability reports. We recognize valid reports with our thanks and, where appropriate, a written acknowledgment of your responsible disclosure.

Our machine-readable contact information is published at /.well-known/security.txt following RFC 9116.