Earlier quoted context omitted.
> Do not attempt to decompile or modify engineer any software included on Buy Me A Coffee site. This is also a bit dated policy. I've reported bugs on Patreon before that involved looking at the source code and modifing it, but it did not cross my mind that they'd reserve the right to ban users for doing so. I think this is a case of copying TOS sections from other places which are not a good fit for this service. Th…
We do have a bug bounty and encourage bug reports from our users ( https://twitter.com/PJijin/status/1186904518341955584 ). The policy mentioned above is to avoid any damages to the creator(s) on the platform. Thanks for the feedback!
You have a policy that guarantees every single security researcher that inspects your platform will be in violation of your TOS. But you're telling us on an Internet forum that you won't use that policy unless someone does something completely awful. That's asking us to put a lot of trust into you -- trust that you're not willing to reciprocate back to us.
People shouldn't need to break your TOS to report a bug to you, and they shouldn't need to rely on purely your goodwill to protect themselves. Security disclosure is already a really scary process, researchers need explicit guarantees that they won't be prosecuted or sued. If a company tells me that I should just trust them that they won't sue me or ruin my life over a bug report, I stop going through their official disclosure channels, because it's no longer worth the risk. Policies like this are a really good way to get security bugs reported as anonymous Pastebins in the press instead of to your official channels.
I would also note that outside of security research, this bans people from building tools around your site -- browser extensions that automate common tasks or alternate clients that call into unsupported or private APIs. I think that's a really regressive restriction for something as fundamental as a payment platform to have.
Again, maybe your actual policy will be not to go after people who build useful tools -- but in that case, why start out with a TOS that encourages an unhealthy power dynamic, that means you could shut down someone who interops with your service for any reason?
The point of a TOS is to create clarity -- it's an agreement so that both users and platform owners know what's expected of each other. I don't expect a TOS to enumerate literally everything that might happen, but I instinctively recoil away from a TOS that includes onerous restrictions that I'm told to just ignore. A rule that everyone is expected to break is really just a blanket license to selectively punish anyone on your platform for any reason. Why should I as a user trust you with that kind of power?
In regards to protecting creators and avoiding creator damages -- hacking is already a federal crime. What's something that this policy protects you against that couldn't be handled by the Computer Fraud and Abuse Act?