How to report a security issue

• By SMSPool Admin
• July 12, 2025
• Information

At SMSPool, we take our security seriously, as we process a significant amount of sensitive data that we would never want to fall into the wrong hands. We take proper measures to isolate our servers completely, minimizing the risk of a hack if our servers are compromised.

If you discover any bugs or vulnerabilities, we will take them into account and ensure you are compensated based on the severity of the issue.

Requirements

• Do not publish the bug/vulnerability until it has been fixed.
• Do not extract more data than is needed for the PoC.
• Help us prevent user data or internal infrastructure from being leaked.
• Run through the patch with us to ensure that the issue has been solved.

We do retain the right to determine whether the reported vulnerability is eligible for a bug bounty.

Please do not report

• Denial-of-Service (DoS) attacks: We do not permit users to launch DoS attacks against our service.
• Vulnerabilities hosted on third-party sites
• Phishing attacks
• Social engineering attacks
• Browser-related issues
• Exploits that require physical device access

To report a security vulnerability or risk, please reach out to the email: [email protected] (PGP) with the following information:

Name	Your name or alias
Proof of Concept	A proof of concept demonstrating the issue
Description	A detailed description of the issue

We currently only provide payouts through bank transfer, and we're looking into adding more payment methods in the future for bug bounties. We appreciate all reports, no matter how big or small, and would like to extend our thanks to all the security researchers who have looked into our site.

Patch notes

Reporter	Issue	Paid out
Anonymous	Hijack account by ID bruteforcing on Telegram SSO	$500.00
Anonymous	One-click hijack through persistent XSS on webhooks	$500.00

Return to knowledgebase