RootBounty is a bug bounty and vulnerability disclosure platform. Companies trust us with unfixed vulnerabilities and researchers trust us with their work, so the security of the platform itself comes first.
This is a vulnerability disclosure program (VDP): there are no monetary rewards, but every valid report is credited publicly on your profile (if you want) and counts towards your reputation.
What we care about most
- Access to reports, messages or attachments of other users or companies
- Authentication and session flaws: account takeover, 2FA bypass, password reset issues
- Privilege escalation between roles (researcher, company member, company admin, staff)
- Exposure of personal data, API keys or payout information
- Injection flaws (XSS, SQLi, SSRF, RCE) on any RootBounty service
Guidelines
Rules
- Only test against
*.rootbounty.com. - Use your own accounts. If you need a company account to test, create one yourself and name it so it is clearly a test (e.g.
test-<yourhandle>). - Do not access, modify or delete data that is not yours. If you reach other users' data, stop, take the minimum evidence needed and report it right away.
- No denial of service, load testing or automated scanning that generates heavy traffic.
- No social engineering, phishing or physical attacks against RootBounty staff or users.
- Do not use the vulnerability beyond what is needed to prove it.
Out of scope
- Missing security headers or cookie flags without a demonstrated impact
- Clickjacking on pages without sensitive actions
- CSRF on logout or other actions with no security impact
- Rate limiting issues without a clear impact
- Reports from automated scanners without a working proof of concept
- Self-XSS, and issues that require a compromised device or browser
- SPF/DKIM/DMARC configuration
- Vulnerabilities in third-party services we use, unless they are caused by our configuration
How to report
Include a clear title, the affected URL or endpoint, step-by-step instructions to reproduce it, the real impact and a proof of concept. One vulnerability per report.
Our commitment
- We will acknowledge your report within 5 business days and keep you updated until it is resolved.
- We will not take legal action against researchers who act in good faith and follow these rules.
- Nothing is made public unless both sides agree.