
# Bug Bounty

If you find a security vulnerability on Search NEU I'll buy you a burrito from Qdoba 🌯🎉! Make sure to keep the vulnerability details secret when letting us know about it. A great way to let us know is to email us at hey@searchneu.com or to send Ryan a FB message at [m.me/ryanhughez](https://m.me/ryanhughez). 

Security vulnerabilities include: 
- Changing the code on production
- XSS vulnerabilities/running code in other people's browsers
- Publishing a new version of the searchneu package on [npm](https://www.npmjs.com/package/searchneu) without permission 
- Accessing the environmental variables on [travis](https://travis-ci.org/ryanhugh/searchneu/builds)

Vulnerabilities do not include:
- DDOSing the server (please don't spam the server with requests 😖).
- Social engineering attempts on our team or trying to change things with unauthorized access to a team member's computer

In the end the ultimate decision over the burrito award 🌯 is a decision that is entirely up to the team. 
