Morphos.media | Sovereign Matrix Generative Pipeline

Security & Bug Bounty

Morphos.media operates a 100% Sovereign, highly scalable media generation architecture. We believe the most resilient systems are forged through adversarial stress-testing. Rather than relying solely on private audits, we are opening our infrastructure to the community.

Rules of Engagement

Do not execute destructive attacks (e.g., mass deletion, DB drops).
Do not attempt to pivot into our B2 object storage backend horizontally.
Social engineering against Morphos staff or users is strictly out of scope.
Automated vulnerability scanners (e.g., Nessus, Burp Suite active scans) must be strictly throttled.
To submit a vulnerability, compile a detailed markdown report with precise reproduction steps and email it securely to hi+security@morphos.media. Bounties are paid in USD via Stripe or Crypto.

Bounty Tiers

CriticalRCE, DB dump, Webhook spoofing
$5,000+
HighAuth bypass, Account takeover
$2,500
MediumStored XSS, CSRF on sensitive actions
$1,000
LowReflected XSS, minor logical flaws
$200

In Scope & Transparency Protocol

Morphos.media is built on a 100% stateless infrastructure leveraging FastAPI, Next.js, Stripe, and Backblaze B2. Our Bug Bounty explicitly targets the cryptographic and logical boundaries of this architecture. You are authorized to pentest the following vectors on our live production matrix:

Authentication & Identity

Our passwordless magic link system relies on ephemeral tokens and Resend dispatch. Any bypass allowing account hijacking, token spoofing, or session hijacking is strictly in scope.

Financial & Webhooks

Stripe webhooks independently control credit orchestration and Pro tier status. Vulnerabilities allowing credit inflation, webhook manipulation, or cryptographic signature bypass are categorized as Critical.

C2PA & Storage Boundaries

Media generation manifests are cryptographically embedded via C2PA and pushed to Backblaze B2. Exfiltrating tokens, tampering with metadata, or bypassing B2 bucket boundaries are primary targets.

Prompt Injection & Input Validation

We ingest high-variance prompts for Imagen 4 and Veo 3. Cross-Site Scripting (XSS) within gallery prompts, or Server-Side Request Forgery (SSRF) within our API ingestion layers are in scope.