Email [email protected]. Include a clear subject, your public username if relevant, the page or record involved, and a concise factual explanation. Say what correction or outcome you are requesting. Bad Bounties is a PhantomBugz project.
No continuous monitoring, response time, or outcome is guaranteed. Sending an email does not automatically change or remove an account, post, or record. Payment does not buy priority, editorial treatment, or a different review standard.
What to include
Send only the nontechnical context needed to understand your request. Do not send attachments, PoCs, exploit code, reproduction instructions, technical vulnerability details, or links to technical proofs. Never send a password, authenticator secret, backup code, verification link, wallet secret, seed phrase, government ID, or unredacted private third-party correspondence.
Report content
Identify the relevant page, words, or conduct and explain your concern without reposting private or prohibited material. Distinguish facts you can support from uncertainty. A report is a request for review; it does not itself establish a violation or guarantee that content will be removed.
Program representatives can also add factual context or a resolution in the relevant public discussion after completing account verification and two-factor authentication. Clearly disclose your affiliation. Public discussion is visible to others and is not a private support channel.
Request review of a decision
If you believe a publication, review decision, or account restriction contains a factual mistake, send one concise request with the record or decision involved, the specific disputed fact, and relevant nontechnical context. Explain which information is new and what correction you seek.
Existing restrictions remain in place while a request is considered. Review does not guarantee publication, reversal, reinstatement, or a second vote. Staff-confirmed violations remain subject to the permanent-ban policy in the Rules.
Account-access requests are separate from moderation appeals. A password reset does not remove two-factor authentication. There is no routine recovery that bypasses a second factor; only exceptional circumstances may receive owner review, and restoration is never guaranteed. A shared-network eligibility problem can be reported, but a network address does not establish that two accounts belong to one person.
Privacy requests
To ask about your information or request a copy, correction, withdrawal, or deletion, identify the account or record using only the information needed to locate it. Verification may be needed without asking for authentication secrets. Read Privacy for information about stored records, service providers, public content, and backups. An email request does not provide instant or automatic erasure.
Staff-interest requests
A staff-interest submission is an expression of interest in possible future opportunities. It is not an advertised opening or a promise of work, compensation, appointment, or staff access. Paid membership does not affect selection.
Your current staff-interest record has no automatic expiry. Updating it replaces the current application; changing its status to reviewed or closed does not erase it. The record remains stored unless it is removed. Email to request withdrawal, correction, or deletion, identifying your public username and the request. Sending the request does not immediately change or remove the record.
For future submissions, include only relevant experience, availability, conflicts, and motivation. Do not include a resume, sensitive personal information, technical reports, or attachments.