Security is a team effort, and we believe the security research community plays a vital role in keeping our platform and users safe. Today, we're thrilled to announce major enhancements to our bug bounty program, including significantly increased rewards, expanded scope, and improved processes that prioritize researcher experience.

Why Bug Bounties Matter

In 2025, the security landscape has never been more complex. According to recent industry data, companies distributing millions in bug bounty rewards have identified and resolved thousands of potential vulnerabilities before they could be exploited. The most successful programs understand that security researchers are partners, not adversaries, in the mission to build secure software.

Our bug bounty program has been running since 2023, but we've learned that simply having a program isn't enough. We need to create an environment where the world's best security researchers want to focus their attention on our platform. That requires competitive rewards, clear communication, and a commitment to treating researchers with the respect they deserve.

Dramatically Increased Rewards

We're more than doubling our maximum payouts to reflect the true value that security researchers provide. Our new reward structure recognizes both the severity of vulnerabilities and the quality of submissions:

New Reward Tiers

Critical Vulnerabilities: Up to $100,000

• Remote code execution on core infrastructure
• Authentication bypass affecting all users
• Data breach exposing sensitive user information
• Full account takeover vulnerabilities

High Severity: $25,000 - $50,000

• SQL injection in production systems
• Cross-site scripting (XSS) with significant impact
• Privilege escalation vulnerabilities
• Server-side request forgery (SSRF)

Medium Severity: $5,000 - $15,000

• Information disclosure of non-sensitive data
• Cross-site request forgery (CSRF)
• Security misconfigurations with demonstrated impact
• Denial of service vulnerabilities

Low Severity: $500 - $2,500

• Minor information leakage
• Best practice violations with security implications
• Low-impact vulnerabilities requiring significant user interaction

Bonus Multipliers

Following industry best practices, we're introducing bonus multipliers for exceptional submissions:

• Quality Bonus (up to 50%): Clear, detailed reports with proof-of-concept code and comprehensive remediation guidance
• First Discovery Bonus (25%): Being the first to report a specific vulnerability class
• Exploit Chain Bonus (up to 100%): Demonstrating full exploit chains that achieve real-world impact
• AI Security Bonus (50%): Vulnerabilities specific to our AI systems, including prompt injection and model manipulation

These multipliers can stack, meaning a critical vulnerability reported with exceptional detail could reach $200,000 in total rewards.

Significantly Expanded Scope

We're opening up more of our infrastructure to security research, recognizing that comprehensive coverage makes us all safer.

Now In Scope

Core Platform Infrastructure

• All production web applications and APIs
• Mobile applications (iOS and Android)
• Authentication and authorization systems
• Database infrastructure and data storage
• Internal admin panels and tools

AI and Machine Learning Systems

• AI model endpoints and inference systems
• Training data pipelines and storage
• Prompt injection and model manipulation
• AI-assisted content generation systems
• Machine learning model security

Cloud Infrastructure

• AWS, Google Cloud, and Azure deployments
• Kubernetes clusters and container security
• CDN and edge computing infrastructure
• CI/CD pipelines and deployment systems

Third-Party Integrations

• OAuth implementations
• SSO and SAML integrations
• Webhook delivery systems
• API integrations with partner services

Explicitly Out of Scope

To help researchers focus their efforts effectively, we've clearly defined what's outside our program:

• Social engineering attacks against our employees
• Physical security of our offices
• Denial of service attacks (unless you can demonstrate them safely)
• Spam or content manipulation
• Issues in third-party services we don't control
• Vulnerabilities requiring jailbroken or rooted devices

Industry-Leading Response Times

Speed matters in security. We've committed to industry-leading response times based on feedback that researchers value quick, human responses:

Our Response SLA

• Initial Triage: 24 hours - A human security engineer reviews your submission within one business day
• Validation: 5 business days - We confirm whether the issue is valid and in scope
• Severity Assessment: 7 business days - Final severity rating and reward amount determined
• Payment Processing: 14 business days - Rewards paid after vulnerability is confirmed fixed

These timelines represent our maximum response windows. In practice, our average time-to-triage is under 12 hours, and we often validate critical submissions within 48 hours.

Transparent Communication

Every submission receives detailed, human-written feedback. Even if we determine a submission is out of scope or not a security issue, we explain our reasoning and provide guidance for future research.

We track three key metrics publicly on our program dashboard:

• Time-to-Triage: How quickly we provide initial feedback
• Time-to-Validate: How long it takes to confirm vulnerabilities
• Time-to-Fix: Our average remediation time by severity level

Public Recognition and Hall of Fame

Security researchers deserve recognition for their contributions. We've created multiple ways to celebrate their work:

Annual Security Researcher Awards

Each year, we recognize outstanding contributors with special awards:

• Top Researcher Award: $10,000 bonus for the researcher with the most impactful findings
• Rising Star Award: $5,000 for exceptional work by a new researcher
• Innovation Award: $5,000 for creative vulnerability discovery techniques
• Community Champion Award: Recognition for helping other researchers

Public Hall of Fame

With researcher permission, we maintain a public hall of fame listing:

• Total vulnerabilities discovered
• Total earnings from our program
• Specific high-impact vulnerabilities discovered (after remediation)
• Researcher profile and social media links

Researchers can choose to be listed anonymously or use handles if they prefer.

Conference Speaking Opportunities

We actively support researchers presenting their findings at security conferences. If your discovery represents novel research, we'll:

• Coordinate disclosure timelines to align with conference talk deadlines
• Provide support letters for conference proposal submissions
• Cover travel expenses to present findings (up to $2,500)

Safe Harbor and Legal Protection

We provide clear safe harbor protections for good-faith security research:

What's Protected

As long as you:

• Make a good faith effort to comply with our program policies
• Don't access, modify, or delete user data beyond what's necessary to demonstrate a vulnerability
• Don't intentionally harm our users or infrastructure
• Report vulnerabilities promptly and don't publicly disclose before we've had time to fix them

We will:

• Not pursue legal action against you
• Work with law enforcement to advocate on your behalf if someone else pursues legal action
• Consider your actions authorized security research