>_
Login

Security & Vulnerability Disclosure

Effective Date: October 26, 2026

Security is fundamental to ModVC. This document outlines our technical infrastructure defenses, data isolation practices, and guidelines for researchers participating in our Vulnerability Disclosure Program.

1. Security Architecture & Defenses

ModVC employs defense-in-depth engineering across all network and data layers:

Authentication & Session Security

User sessions are validated using signed JWT tokens minted and verified with RS256 cryptography. Sensitive temporary tokens (such as email authentication codes) are hashed with salted HMAC SHA-256 before database storage.

Isolated Financial Data (PCI-DSS)

By partnering with Whop Inc. as our Merchant of Record, ModVC servers never touch, process, or store credit card numbers, card verification codes (CVV), or bank account numbers. Financial transactions remain completely isolated within PCI-DSS certified infrastructure.

Edge Protection & Rate Limiting

All edge traffic routes through Cloudflare with strict TLS 1.3 encryption and DDoS mitigation. Server endpoints enforce sliding-window IP rate limiting (auth_rate_limits) to safeguard against credential stuffing and brute force attacks.

Input Sanitization & AI Moderation

All user inputs (handles, bio links, supporter messages) are sanitized and validated against strict schemas. Supporter messages are evaluated using OpenAI's omni-moderation-latest endpoint in a fail-closed configuration before broadcast on live stream overlays.

2. Vulnerability Disclosure Program (VDP)

We welcome vulnerability reports from independent security researchers and ethical hackers who believe they have discovered a security issue in ModVC.

Reporting Channel

Please submit security reports via email to: support@modvc.org with the subject line "Vulnerability Report - [Short Description]".

Please include:

  • Detailed description of the vulnerability and its potential impact.
  • Step-by-step reproduction instructions or proof-of-concept (PoC) code.
  • Any relevant target URLs, HTTP requests, or parameters.

3. Rules of Engagement

To maintain safe harbor and eligibility for recognition:

  • Do not harm users: Do not access, modify, or delete data belonging to other users. Only test against accounts you own.
  • No service disruption: Do not execute Denial of Service (DoS/DDoS) attacks, spam forms, or degrade production performance.
  • No social engineering: Do not attempt phishing, physical attacks, or social engineering against ModVC employees or creators.
  • Coordinated Disclosure: Give our team reasonable time (at least 30 business days) to investigate and deploy a fix before publicly discussing the issue.

4. Safe Harbor Commitment

If you conduct vulnerability research in good faith and comply with these guidelines, ModVC considers your activities authorized. We will not pursue civil action or initiate criminal complaints against researchers who discover and report issues in accordance with this policy.