Help us keep BotDigit secure.
We welcome ethical security researchers to inspect our platform and report vulnerabilities responsibly. Valid findings receive Official Certificates of Honor, permanent Security Hall of Fame listing, and Linked Freelancer Profile Badges. (Notice: Upfront cash bounties are temporarily paused due to operational restructuring; all validated reports receive immediate professional honors, certificates, and are permanently prioritized for retroactive cash bounty payouts upon our financial recovery).
Security Vulnerability Disclosure & Hall of Fame Program
BotDigit deeply values security researchers and ethical hackers who help safeguard our platform. Due to recent operational financial losses and restructuring, upfront monetary cash bounties are temporarily on hold. However, all valid, reproducible vulnerability reports are immediately awarded Official Certificates of Honor (with cryptographic QR validation), permanent Security Hall of Fame induction, verified profile badges, and 100% lifetime marketplace fee exemptions. Furthermore, every eligible submission (past and ongoing) is permanently tracked in our security ledger: as soon as BotDigit achieves financial recovery, eligible researchers will be prioritized for retrospective cash bounty payouts.
Recognition-First Program
Policy Notice on Cash Rewards: Upfront monetary cash bounties are currently paused due to financial restructuring. In the interim, all verified findings are formally acknowledged with verifiable professional honors, Hall of Fame listing, cryptographic certificates of appreciation, and executive commendations. All qualifying submissions remain recorded in our priority queue for retroactive monetary rewards once financial recovery is complete.
Separation of Validation & Rewards
Security vulnerability validation confirms technical accuracy. In accordance with program rules, all valid findings receive immediate official professional honors and credentials, and are queued for retroactive financial consideration.
Severity Tiers & Recognition Rewards
Recognition includes official certificates of honor, executive appreciation letters, permanent Hall of Fame listing, and verified profile badges.
Examples: Remote Code Execution (RCE), Escrow bypass or unauthorized contract state manipulation, Authentication bypass or privilege escalation to admin, Full production database compromise or SQL injection
🎁 Recognition: 📜 Official Verifiable Certificate of Honor (QR Validated) · 🏆 Security Hall of Fame Listing (Permanent Honor Roll) · ✉️ Formal Executive Letter of Thanks & Commendation · 💼 Verified Security Auditor Badge on Freelancer Profile · ⚡ 100% Lifetime Platform Fee Exemption on Freelance Work
Examples: Stored Cross-Site Scripting (XSS) with meaningful business impact, Sensitive PII Insecure Direct Object Reference (IDOR), Payment-flow bypass or contract manipulation logic flaw, Account-takeover Cross-Site Request Forgery (CSRF)
🎁 Recognition: 📜 Official Verifiable Certificate of Honor · 🏆 Security Hall of Fame Listing (Permanent Honor Roll) · ✉️ Formal Executive Letter of Thanks & Commendation · 💼 Verified Security Auditor Badge on Freelancer Profile
Examples: Reflected XSS requiring minimal user interaction, Subdomain takeover on active corporate domains, Broken access control on non-critical endpoints or user metadata, Logic flaws permitting unauthorized feature access
🎁 Recognition: 📜 Official Verifiable Certificate of Honor · 🏆 Security Hall of Fame Listing (Honor Roll) · ✉️ Formal Executive Letter of Thanks & Appreciation · 💼 Verified Security Auditor Badge on Freelancer Profile
Examples: Open redirect with actionable phishing potential, Information disclosure of non-sensitive environmental data, Missing security headers with demonstrated actionable exploit PoC, CORS misconfigurations exposing non-sensitive data
🎁 Recognition: 📜 Official Verifiable Certificate of Honor · 🏆 Security Hall of Fame Listing (Honor Roll) · ✉️ Formal Letter of Thanks & Appreciation
Examples: Security hardening recommendations & best practices, Theoretical weaknesses without demonstrated exploitability, Reports outside monetary criteria or non-exploitable findings
🎁 Recognition: 📜 Certificate of Acknowledgment · 🏆 Security Hall of Fame Listing (Honor Roll) · ✉️ Official Letter of Thanks
What Counts as a Valid Security Finding?
To qualify for technical review and potential bounty consideration, every disclosure must satisfy the following baseline criteria:
Duplicate Report Policy
First Valid Researcher: The first independently submitted, sufficiently reproducible report is eligible for primary recognition and reward review.
Duplicate Reports: Subsequent duplicate reports describing the same underlying issue or root cause generally do not receive an additional award. Multiple reports describing the same underlying vulnerability are treated as one finding.
BotDigit may evaluate evidence of independent discovery when determining recognition-only awards (certificates and Hall of Fame acknowledgments).
Severity Is Not Self-Declared
Researchers select a preliminary severity rating during submission to assist initial triage.
However, the preliminary severity is not final. BotDigit's security team reassesses the final severity based on demonstrated exploitability, required attack prerequisites, realistic business impact, and affected assets.
Selecting "Critical" in the submission form does not automatically entitle the report to the Critical reward range.
In-Scope Targets
An endpoint being technically accessible does not automatically make every associated behavior eligible for a bounty.
botdigit.com— Primary Marketplace & Freelance Workspace Appbotdigit.com/api/v1/*— Backend Gateway Microservices & Auth EndpointsEscrow & Smart Contract APIs— Payment Transaction Verification & Release SystemsBotDigit Wallet APIs— Internal Ledger, Top-Up & Payout Handlers
Out-of-Scope & Prohibited Targets
- Admin infrastructure, internal staging databases, and production vault secrets
- Spam, phishing, social engineering, physical security, or credential stuffing
- DoS/DDoS attacks, volume-based fuzzing, or automated vulnerability scanner dumps
- Self-XSS (unless chained to actionable privilege escalation)
- Missing security headers or TLS cipher observations without a working exploit PoC
- Public disclosure before the 30-day responsible disclosure window has elapsed
Testing Standards & Prohibition of Degradation
Required Safe Testing Conduct
- •Use only researcher-owned test accounts for validation.
- •Execute minimal requests required to demonstrate technical proof of concept.
- •Immediately halt testing upon confirming vulnerability existence.
- •Handle any inadvertently accessed data with strict confidentiality.
Prohibited Testing Activities
- •Do not access, download, or inspect another user's private data beyond the absolute minimum required to prove the flaw.
- •Do not modify, corrupt, or delete production data or user records.
- •Do not transfer, escrow, or withdraw funds belonging to other users.
- •Do not perform destructive database queries or account lockouts.
- •Do not conduct high-volume traffic tests, stress tests, or automated scanner dumps.
- •Do not disrupt platform availability or cause service degradation.
- •Do not execute physical attacks, phishing, social engineering, or spam against BotDigit staff or users.
Recognition, Platform Privileges & Future Payout Eligibility
Zero Cash BountiesWhile upfront cash disbursements are temporarily paused during our financial turnaround, BotDigit honors contributing researchers with verifiable professional credentials, portfolio assets, and priority queuing for future cash disbursements.
📜 Cryptographic Credentials
Issued certificates include public SHA-256 verifiable links and QR codes proving your security discovery to employers and clients.
🏆 Hall of Fame Attribution
Permanent listing on the BotDigit Security Honor Roll honoring independent researchers who help safeguard the ecosystem.
⚡ 100% Fee-Exemption
Security contributor accounts receive 100% lifetime exemption on platform escrow fees for their freelance client contracts.
Triage Lifecycle & 30-Day Confidentiality
Researchers must keep all vulnerability information strictly confidential while BotDigit investigates and deploys remediation. Researchers must not publicly disclose the vulnerability during the first 30 days following acknowledgment unless BotDigit provides express prior written authorization.
Submission
Researcher submits complete report with reproduction steps and PoC.
Acknowledgment
Security Desk provides tracking ID within target SLA (48h initial response).
Triage & Validation
Security engineers verify scope, reproducibility, impact, and duplicate status.
Decision
Finding is categorized as Valid + Reward Eligible, Valid + Recognition Only, Duplicate, Informational, Out of Scope, or Invalid.
Recognition & Remediation
Certificates and Hall of Fame honors are published, patches deployed, and any discretionary credit credited.
Requesting Reconsideration
Researchers may request formal reconsideration of severity assignments, duplicate determinations, reward eligibility, or recognition status by replying to their ticket email or contacting [email protected] with technical justification. Good-faith appeals and technical discussions are always welcomed.
Responsible Disclosure Program Terms & Researcher Conduct
Program TermsBy submitting a vulnerability disclosure report to BotDigit, security researchers agree to conduct themselves in good faith under the following terms:
1. Non-Coercion & Good Faith
Researchers must not threaten public disclosure to force payment, demand compensation outside the published program, or threaten users or personnel. Legitimate, good-faith technical questions and appeals regarding bounty decisions are explicitly welcomed and do not constitute coercion.
2. Confidentiality & Public Disclosure
Researchers must keep findings confidential during the initial 30-day investigation and patching window. Researchers must not knowingly publish false factual claims, fabricate proof of concept evidence, or impersonate BotDigit personnel.
3. Program Framework & Discretion
Published scope and severity tiers describe the program's recognition framework. Submitting a report does not create an entitlement to monetary compensation. BotDigit operates a 100% recognition-first program awarding verifiable certificates, Hall of Fame entries, and non-cash platform benefits following technical validation.
4. Non-Retroactive Program Application
The applicable bounty rules are those published and accepted at the time the report is submitted. Future updates or modifications apply prospectively to reports submitted after updated terms become effective.
Submit a Security Report
You will receive a tracking reference ID. Our security desk targets an initial acknowledgment response within 48 hours target.
Questions regarding our security program? Contact our security desk directly at [email protected]