Found a security issue?

Help us protect the people who use Busted. Send a private report to the team at Lahta LLC.

Contact: founders@lahta.co
Suggested subject: Busted security report

What to include

• The affected page or app version and a short description of the issue.
• Steps to reproduce it using your own account or data.
• The possible impact, and redacted screenshots or a minimal example if helpful.
• A reply address so we can ask questions and share progress.

Do not send passwords, access tokens, Instagram exports, or other people’s personal information. If evidence contains sensitive information, describe it first so we can agree on a suitable way to share it.

Research with care

Use only systems and accounts you own or have permission to test. Do not access other people’s information, interrupt service, perform denial-of-service attacks, or test Instagram, Meta, or other third-party systems on our behalf. Stop if you encounter unexpected personal data and report the circumstances without retaining it.

What happens next

We review reports, may ask for more detail, and use the same email thread to discuss findings and next steps. Please allow us to investigate before publishing technical details. We do not currently offer a paid bug bounty or a guaranteed response time.

Current development status

Busted is in development. This website does not accept Instagram uploads or provide account login. Live Instagram transfer and multiplayer features are not publicly available. We do not claim an independent security certification or completed security audit.

Privacy requests

To leave the waitlist or ask for personal-data deletion, use the data deletion instructions. See the privacy policy for how reports and other correspondence are handled.