Bug Bounty
Found a security hole in one of my projects? Report it responsibly and I'll fix it fast. Valid, in-scope issues get a reward as a thank you for helping keep wildanoel.dev safe.
Reward per valid report
2M (Makasih Mas)
Rewards by severity
Every accepted, in-scope report earns the same thank-you reward, regardless of severity.
RCE, auth bypass, full account takeover, secret/key leakage.
Stored XSS, IDOR on sensitive data, SSRF, privilege escalation.
CSRF with impact, reflected XSS, sensitive info disclosure.
Missing hardening headers, minor misconfig, rate-limit issues.
In scope
wildanoel.devwww.wildanoel.devemail.wildanoel.devAll subdomains of wildanoel.dev
Out of scope
- Third-party services (Vercel, Cloudflare, GitHub, etc.)
- Social engineering, phishing, or physical attacks
- DoS / DDoS and volumetric / brute-force testing
- Automated scanner output with no proof of impact
- Best-practice reports with no real security impact
Rules of engagement
- 1
Test only assets listed as in-scope. Do not touch anything else.
- 2
No attacks that degrade service for others (DoS, spam, mass requests).
- 3
Do not access, modify, or exfiltrate data that is not yours. Use test accounts.
- 4
Give me reasonable time to fix before any public disclosure.
- 5
One clear report per issue, with steps to reproduce and proof of impact.
How to report
Email a clear write-up to security@wildanoel.dev. Include: the affected asset, a description of the issue, step-by-step reproduction, impact, and any proof (screenshots, PoC, request/response). The more actionable the report, the faster the fix and the reward.
security@wildanoel.dev