[ 01 ] — Hackers — Guidelines
How we disclose, together.
The rules of good-faith research on BugsBounty.com — for researchers and program owners alike.
What is responsible (coordinated) disclosure?
Coordinated disclosure means reporting a vulnerability privately to the affected organisation, giving it reasonable time to fix, and only discussing details publicly once a fix is available or an agreed deadline passes.
01 · Good faith
Test only within published scope, avoid privacy violations and service degradation, and stop as soon as you confirm an issue.
02 · Reporting
Submit through the platform only. Include reproduction steps, impact and any proof of concept.
03 · Confidentiality
Do not share details of an unresolved vulnerability with anyone outside the report.
04 · Public disclosure
Either party may request disclosure once a fix is deployed. Default timeline is 30 days after resolution.
05 · Safe harbor
Programs on the platform commit not to pursue legal action against researchers who follow these guidelines.
[ ∞ ] — Researchers
Ready to hack with us?
Registration is by prior approval only. Approved researchers receive their registration link by email.