Security
Last updated: October 22, 2026
If you find a security vulnerability in Pounce, please tell us privately so we can fix it before it affects anyone. This page explains how to report it, what is in scope, and how we treat good-faith research. Our machine-readable contact file is at /.well-known/security.txt.
How to report
Email [email protected] with:
- a description of the issue and its impact;
- steps to reproduce it, with the app version or URL involved; and
- any proof-of-concept code, screenshots, or logs, with other people's data removed.
Please don't post vulnerability details in public Discord channels or elsewhere. If you can't use email, ask for a private contact in our Discord without sharing the details.
Scope
In scope:
- The current release of the Pounce Windows app, including its local dashboard, update check, and license handling.
- Pounce Cloud at api.pounce.gg.
- This website, pounce.gg.
Out of scope:
- Third-party services such as Facebook, Whop, Discord, Telegram, GitHub, and Cloudflare. Report issues in those services to their owners.
- Denial-of-service attacks, load testing, or anything that degrades the service for others.
- Social engineering, phishing, or physical attacks against our staff or users.
- Attacks that require an already compromised PC or full control of the user's Windows account.
- Automated scanner output, or missing best-practice settings, without a demonstrated security impact.
Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue or support legal action against you for it, and we will work with you to understand and fix the issue. To stay within this safe harbor:
- test only with your own license, accounts, and devices;
- don't access, change, or delete other people's data beyond the minimum needed to show the issue, and stop and tell us if you come across personal data;
- don't disrupt the service or other users;
- give us a reasonable time to fix the issue before you disclose it publicly, and agree the disclosure date with us; and
- follow the law.
We cannot authorize testing of third-party services. If you are unsure whether something is allowed, ask us first.
What to expect
- We acknowledge reports within 3 business days.
- We keep you updated while we investigate and tell you when the issue is fixed.
- With your permission, we credit you when we announce the fix.
We don't run a paid bug bounty program, and we don't pay for reports.
How we protect Pounce
- Local dashboard. The app's dashboard only listens on 127.0.0.1, so it is reachable only from your own PC.
- Encryption on your PC. Saved Facebook passwords, saved Facebook sessions, and your license key are encrypted with Windows DPAPI. Discord webhook URLs, Telegram bot tokens, and proxy credentials are stored in your local settings without encryption, so keep your Windows account protected.
- Encrypted connections. The app talks to Pounce Cloud, update servers, and alert services over TLS (HTTPS). This website is served only over HTTPS with HSTS.
- Signed license receipts. Pounce Cloud issues cryptographically signed, short-lived license receipts that are bound to your license and device.
- Secrets stay on the server. Billing-platform and AI provider credentials live only on Pounce Cloud, never in the app.
- Message safety. AI-written seller messages are filtered to block links, contact details, and payment requests.
See our Privacy Policy for what data Pounce handles and how long we keep it.