RootBounty is not a registered company yet. For now it is a website run by its founder as an individual. When the company is incorporated, this document will be updated with its legal name, tax ID and registered office, and you will be asked to accept the new version. Until then, the rights and obligations described here are those of the person who runs RootBounty.
These terms govern the use of RootBounty (rootbounty.com), the platform run by Pau Valls Peleteiro (“RootBounty”, “we”). By creating an account you accept them, together with the privacy policy. Researchers and companies also sign their own agreement, which completes these terms.
1. What RootBounty is
RootBounty connects organisations that want their systems tested (“companies”) with independent security researchers (“researchers”). Companies publish vulnerability disclosure or bug bounty programs; researchers report the issues they find; the RootBounty team verifies companies and reviews programs. RootBounty is an intermediary: it does not test systems itself and is not a party to the relationship between a company and a researcher beyond what these terms and the agreements say.
2. Accounts
- You must be at least 16 to use RootBounty and of legal age to sign the agreements and receive bounties.
- An account belongs to one person or one organisation and has one role: researcher or company. Company accounts must be opened by someone authorised to act for the company.
- The information you give must be true and kept up to date.
- Two-factor authentication is mandatory. You are responsible for your password, your authenticator, your recovery codes and your email inbox, and for what is done with your account.
- Company accounts and every program are reviewed before they are published. We may decline them.
3. Acceptable use
You must not:
- test systems outside a program's scope or against its guidelines, or use the platform to plan or carry out unlawful activity;
- use a finding to demand payment or anything else outside the program (extortion), or threaten to publish it;
- harass other users, impersonate anyone, or publish third parties' personal data;
- interfere with the platform, bypass its limits or security, or test it outside the security policy;
- create accounts automatically, share accounts, or use the platform to send spam.
4. Content and intellectual property
- You keep the rights to what you publish. You grant RootBounty a non-exclusive, worldwide, free licence to host, show and process it as needed to run the platform.
- Reports are subject to the agreements: the researcher grants the company the rights it needs to understand and fix the issue.
- The RootBounty name, design, software and the mascot Nimbus belong to the owner.
5. Confidentiality
Reports, unpublished programs and everything you see about other users' security issues are confidential. Use them only for the program they belong to and do not disclose them except as the disclosure policy allows.
6. Price
RootBounty currently charges nothing for using the platform. Bounties are paid by companies to researchers as the agreements describe. If we introduce fees we will announce them at least 30 days in advance, and they will not apply to programs already running without your agreement.
7. Availability and liability
- We work to keep the service available and secure, but we do not promise that it will never be interrupted or be free of errors.
- Programs, scopes and rewards are published by the companies, who answer for them. RootBounty does not guarantee the outcome of any report or the payment of bounties it does not make itself.
- RootBounty is not liable for indirect damages or loss of profits, nor for damages caused by companies or researchers. These limits do not apply to damages caused by intent or gross negligence, or where the law does not allow them, in particular towards consumers.
8. Suspension and termination
- You can delete your account at any time in Settings.
- We may suspend or close accounts that break these terms, an agreement, a program's guidelines or the law, or to protect other users. Suspension ends every active session. Where possible we will tell you why.
- What by its nature must survive (confidentiality, licences already granted, liability, records the law obliges us to keep) continues after the account is closed.
9. Changes
We may change these terms to reflect changes in the service or the law. We will announce relevant changes at least 15 days before they apply; if you do not agree you can close your account. Changes to the agreements require a new signature.
10. Law and jurisdiction
These terms are governed by Spanish law. Disputes go to the courts of the owner's domicile, except that consumers keep the right to go to the courts of their own domicile.
11. Contact
- Owner: Pau Valls Peleteiro
- Legal form: an individual; RootBounty is not a registered company yet
- Contact: pauvalls@rootbounty.com