Turn Found Bugsinto Shipped Fixes

A company defines its scope, severity tiers and reward bands, then publishes the program. Assets in scope, rules of engagement and payout ranges are public from the first day, so nobody argues later about what counted.

Researchers filter live programs by asset type, stack, severity band and reward size. Each program page carries the full scope, its payout history and average triage time — you know what you are walking into before you start.

Submit the finding with reproduction steps, impact analysis and a working proof of concept. The report is timestamped the moment it lands, which locks your claim to the vulnerability ahead of anyone else.

The security team reproduces the issue, confirms severity against the published tiers, and either accepts it, asks for more detail, or rejects it with a stated reason. Every state change is written to the report timeline.

On acceptance the bounty is released at the tier the finding landed in, and the report converts into reputation on your public profile. Coordinated disclosure opens once the fix has shipped.

Post the problem as it actually is: the error, the stack, the versions, and what you already ruled out. Tagged threads route to the people who have shipped in that stack before, instead of sitting unread.

Anyone can answer with a solution that works — the code, the config, and the reasoning behind it. The author marks what fixed it, and the thread becomes a validated answer the next person can search for.

Every accepted report and every marked solution adds to your score, weighted by the severity of the finding and by how often the answer gets reused by other people.

Your public profile carries the whole record: severity breakdown, programs contributed to, threads solved, and the badges earned along the way. One link, nothing to explain.

The global leaderboard ranks on contribution rather than volume. Filter it by program, by stack or by time window to see who is actually doing the work right now.