We don't have a formal bug bounty program as of yet. But we do consider on a case by case basis, depending on whether it's already known, the potential business impact and other factors. For us to evaluate it properly, you need to report the details of the security vulnerability to our security team, and they will be in touch shortly.
​
Please report your findings to security@bake.io, and someone from our security team will be in touch with you shortly to inform you about the next steps. Meanwhile, we request you to kindly refrain from disclosing details about the bug anywhere publicly or to other 3rd parties, as doing so can have legal implications and disqualification from any potential monetary reward. Also, allow us some time to investigate.