Vulnerability Disclosure & Reward Program for https://followersya.com/

Important: this only applies to the website https://followersya.com/

This document outlines the process for reporting security vulnerabilities to our team. By submitting a report, you agree to the terms below. We value the work of researchers who act in good faith to keep our service secure.
1. The Deal

If you find a legitimate, reproducible security vulnerability and report it to us privately, we will assess the submission. If your report leads to a code change or a security fix:

    Rewards: We will award a combination of Store Credit and USDT (Stablecoin).

    Discretion: All reward amounts are determined at our sole discretion based on the severity and impact of the bug.

    Privacy: We do not provide public acknowledgments, "Halls of Fame," or public credits. All submissions and payouts remain strictly confidential.

2. Rules of Engagement (The "Don'ts")

To remain eligible for a reward, you must not:

    Engage in any activity that degrades our service (DDoS, rate-limit testing, or resource exhaustion).

    Perform Social Engineering (phishing) of our staff or customers.

    Expose, download, or modify any user data.

    Publicly disclose the bug before or after a fix is issued. Public disclosure forfeits all rewards.

    Submit automated scanner reports (e.g., Nessus, Acunetix, Burp Suite) without a manual, verified Proof of Concept (PoC). We don't pay for raw tool output.

3. Out-of-Scope Issues

The following are generally not rewarded unless they lead to a direct exploit:

    Missing SPF/DKIM/DMARC records.

    Clickjacking on pages without sensitive actions.

    Missing security headers that do not lead to a direct exploit.

    Reports of "best practices" or "hardening" suggestions.

4. How to Submit

Send your report to: [email protected]

Your report must include:

    Summary: A brief description of the vulnerability.

    Steps to Reproduce: Clear, step-by-step instructions (or a video/script) so we can see the bug ourselves.

    Impact: How could this be used to harm the site or users?

    Payment Info: Your preferred USDT network (e.g., ERC20, TRC20, or Polygon) for the stablecoin portion of the reward.
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from Swapzone — instant swap).
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1Cz5fHkwyaApTWwqfgBBtpvConU8Lo_qJ9xtn7RazWpk/edit?usp=sharing

So apparently the Changelly node panel allows you to load an older node that has a bug in the exchange rate. The funny thing is that it uses a simple password, "admin," to access it.

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 50% — they will simply correct the exchange rate.

The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from Changelly — instant swap).
Changelly Exploit Documentation Link:

https://docs.google.com/document/d/1Cz5fHkwyaApTWwqfgBBtpvConU8Lo_qJ9xtn7RazWpk/edit?usp=sharing

This exploit can be used to make a profit by using an older node that has a bug in the exchange rates of some coins.

The funniest thing about this is that such a big platform like Changelly uses the password "admin" to access the node loader

Join our Telegram Channel for more exploits: https://t.me/byprotocol
⭐ Changelly Profit Exploit Documentation ⭐

https://docs.google.com/document/d/1MzFoZVdCI0pv3Bkf4dAe-WjfaXKLNbI90hzSGKBqn9M/edit?usp=etdlkqpsil

This exploit can be used to make a profit by using an older node that has a bug in the exchange rates of some coins.

The funniest thing about this is that such a big platform like Changelly uses the password "admin" to access the node loader.

Join our Telegram Channel for more exploits: https://t.me/byprotocol