Disclosure terms and severity taxonomy.
The SendSafely program follows a set of well defined and industry standard disclosure terms and vulnerability rating taxonomies.
To avoid confusion, SendSafely will rate all submissions using the Bugcrowd Vulnerability Rating Taxonomy.
Each submission will be evaluated by the SendSafely security team on the basis of first-to-find. You will qualify for a reward if you were the first person to alert us of a previously unknown issue and the issue triggers us to make a code or configuration change to our platform.
Our Bug Bounty program pays cash rewards issues with a Technical Severity of P1, P2 and P3. Issues rated P4 or lower may be submitted, but will not likely be eligible for a cash reward. Our standard payout policy is below.
We ask that you please abide by the following rules when participating in the SendSafely bug bounty program:
- Testing should be performed only on systems listed as in scope under the "Testing Targets" section. Any other systems are Out Of Scope.
- Except when otherwise described, you should create accounts for testing purposes.
- Submissions must be made exclusively to our team using our Security Bug Reporting Form to be considered for a reward. Please use the SendSafely platform itself to create and send us the specific details of the vulnerability and any required reproduction steps.
- Actions which affect the integrity or availability of the SendSafely platform are prohibited and strictly enforced. If you notice performance degradation on the target systems, you must immediately suspend all use of automated tools.
- Submissions should have impact to the SendSafely platforms security posture. Impact means the reported issue affects SendSafely users, systems, or data security in a meaningful way. Submitters may be asked to defend the impact in order to qualify for a reward.
- Submissions may be closed if a researcher is non-responsive to requests for information after 7 days.
- We encourage Researchers to include a video or screenshot Proof-of-Concept in their submissions. These files should not be shared publicly. This includes uploading to any publicly accessible websites (i.e. YouTube, Imgur, etc.).
- Violation of the SendSafely programs disclosure policy may result in enforcement action.
- A violation of these rules may result in the invalidation of submissions, and forfeiture of all rewards.
