Reward what gets fixed
You publish a bounty table by severity and pay only for valid, in-scope findings you accept.
- Attracts experienced researchers
- You set the amounts and the scope
- Public, or private by invitation
● Bug bounty · Vulnerability disclosure
Find the flaws in your product before someone else does.
Invite independent security researchers to test what you build. They report what they find in a format your team can act on, under rules you set — and nothing is made public without you.
- Companies verified by people
- Two-factor on every account
- Coordinated disclosure
ReportsExample
High#128 · CWE-639Triaged
Any customer can download another customer’s invoices
8.7CVSS 4.0
- Submitted
- Triaged
- Accepted
- Resolved
- MediumPassword reset link stays valid after useNew
- LowVersion disclosed in an error pageResolved
How it works
From sign-up to your first report in four steps.
- 1
Register your organisation
Our team verifies who you are before anything goes live.
- 2
Write the rules
Scope, guidelines, response times and — if you pay — your bounty table.
- 3
We review, you launch
Every program is checked by a person. Public, or private by invitation.
- 4
Triage from one inbox
Reports arrive in one format. Talk to the researcher, decide, close.
Two kinds of program
Pay for results, or simply open the door.
A front door for good faith
A vulnerability disclosure program gives anyone who finds a problem a safe, official way to tell you. No bounties.
- Researchers are credited publicly
- Shows customers you take security seriously
- A good first step before a bounty
For companies
Built so your team stays in control.
Researchers you can trust
Every account is behind two-factor authentication, and reputation is earned only with findings a company accepted.
Reports you can act on
CWE, a scored CVSS 4.0 vector and reproducible steps in every submission. No follow-up questions to start.
Private when you need it
Start with a handful of invited researchers and open up when you are ready.
You decide what is public
Nothing about a report is disclosed without you. Full reports only when both sides agree.
Bounties in one ledger
Award a bounty when you accept a finding and follow every payment until it is settled.
Hire the people who found it
Publish job offers to a community that already knows your product.
The report
One format. Written in Markdown.
Every submission has the same eight parts, so triage starts from facts instead of follow-up questions.
- 01 Title
- What is broken, where, and what it allows.
- 02 CWE
- The weakness class, from MITRE’s catalogue.
- 03 CVSS 4.0
- A scored vector, calculated as you pick the metrics.
- 04 Description
- Where the flaw lives and why it happens. Markdown.
- 05 Impact
- What an attacker gains and who is affected.
- 06 Environment
- Versions, accounts, browser, configuration.
- 07 Proof of concept
- Steps anyone on the team can reproduce.
- 08 Attachments
- Screenshots, captures, scripts — scanned and private.
For researchers
Hunt, report, get credited.
- Read a program’s guidelines and scope before you touch anything.
- Submit a report with CWE, a CVSS 4.0 vector and a reproducible proof of concept.
- Follow triage in the open: every resolved finding lands on the program’s public hacktivity.
- Ten certified findings unlock posts and stories in the community.
Ready to be tested by people who care?
Create your company account today. We review it, you write your program, and researchers get to work.