Bug Bounty disclosure program

Program
rules

• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.

• Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.

• When duplicates occur or known vulnerabilities, we only award the first report received (provided that it can be fully reproduced).

• Multiple vulnerabilities caused by the same underlying issue will be awarded one payout.

• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.

• Test vulnerabilities only on accounts you own or have explicit permission from the account holder.

• Report Wordpress plugin vulnerabilities to Patchstack.