Security at Bounty Operator

The review engine is one set of modules. The browser, the Worker and the MCP server import the same files, and they are in the public repository with the three core profiles. The method of every other profile is not in the repository: the Worker adds it when a review runs.

For a core profile the preview is the whole prompt your model receives. For a hosted profile it is the request: your focus, your context and the files, line by line. The Worker adds the method after that, and the provider you chose is the only other party that receives it. No page, download or API response returns it.

A review started from a coding agent takes the same path: run_review sends the files and your provider key to the Worker, and steps 2 and 3 are unchanged.

The privacy policy has the full list with retention times.

The Worker sets these on every response, pages and API alike:

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self' https://api.github.com https://openrouter.ai; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cross-Origin-Opener-Policy: same-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: no-referrer
Permissions-Policy: camera=(), microphone=(), geolocation=()

What the policy means in practice:

Check it yourself:

curl -sI https://bountyoperator.com/ | grep -i -E "content-security|strict-transport|cross-origin|x-frame|referrer|x-content|permissions"

Connection tokens

A connection token starts with bok_ and lets an AI client do two things: read your usage and run a review. It cannot reach billing, passkeys, recovery or deletion. A token lasts 90 days, an account holds three, and revoking one takes effect at once.

Provider calls

Each provider has one fixed endpoint. The Worker refuses redirects, stops when the provider has been silent for 180 seconds, and caps the answer at 2 MB. Your API key is used for that request and is redacted from any error message.

Hosted profiles

The Worker reads the answer to a hosted profile as it streams, in memory, before it reaches you. An answer that repeats the method of the profile is stopped and the call ends with the code output_withheld. A file or a request that asks the model for its instructions is treated as data.

Input checks

A review takes up to 50 text files and 240 KB in total. Before anything is sent, the engine scans every line for API keys, access tokens, wallet keys and seed phrases, and blocks the request when it finds one. Email addresses and IP addresses are warnings you confirm. A finding names the file, the line and the kind of match, and never the matched text.

Billing

Payment runs on Stripe Checkout, so card details never touch our application. Webhooks are signature-checked, and paid access is recomputed from Stripe’s current state on every event, including refunds and disputes.

Include:

• the affected surface, and the version or the time of the request
• a minimal reproduction
• the impact: what an attacker reads, changes or spends
• a proposed fix, if you have one

Remove secrets and other people’s data from anything you attach.

In scope

Testing rules

• Use accounts you created. Leave other accounts alone.
• Keep request volume low. No denial-of-service testing and no automated scanning of the production site.
• Do not test payments against the live checkout. The billing logic runs locally with billing disabled.
• Stop at the first proof of a problem and report it.

The full policy is in SECURITY.md. The machine-readable contact is at /.well-known/security.txt.

The source is public under the MIT licence: the Worker, the review engine with its three core profiles, the free tools, the MCP server and the command-line kit. The gauntlet stages and the panel cross-examination run on the hosted service. The licences page lists every dependency. The changelog lists what shipped and when.

A Worker built from the repository runs the hosted profiles on short stand-in instructions, and its /api/health reads "profiles": "community". On this site it reads "profiles": "hosted".