Hey everyone, this is Radyslav, co-founder & CTO at OnlyMonster.

Quick update on our bug bounty program and security overall.
Over the past few days we've received a lot of reports - and I really want to thank everyone who took the time. Your reports helped us look past individual bugs and identify the root cause: a systemic issue in our session management architecture.

What we found: all reports come down to one systemic problem, and we know exactly what it is.

What we're doing: instead of patching each instance one by one, we're redesigning the architecture from the ground up. Session tokens will no longer be obtainable on the client side for our main platform. This is a fundamental change and we'll be rolling it out in the coming days. Other platforms will follow shortly after.
We have the full picture of current vulnerabilities and we're closing them one by one. At the same time we're trying to keep the balance - keep shipping new features for you while strengthening security. Bug bounty actually helps us prioritize this the right way.

What's changing with bug bounty:
Starting now, reports describing the already documented vulnerability class (session token extraction and its variations) are classified as a known issue and will not count as new findings for payouts. This is standard practice for any bounty program, the program stays open.
Found a fundamentally different class of vulnerability - send it over. We'll review and reward.
We opened this bug bounty on purpose, knowing it wouldn't be easy. We believe transparency and working with the community is the right way to do this.

Recently our team has been dealing with cyberattacks, pressure on our employees' personal accounts, and service providers dropping us with no explanation. No drama here - just want you to know we're standing, holding, and keep working. Support is up, issues are getting closed, we're here as always.
We'll post another update here once the architectural changes are live.
Thanks for your patience and for caring.

Radyslav, co-founder & CTO at OnlyMonster