Bug Bounty Program

Step 1Write the scope

Assets, rules, safe harbour and rewards.

ATALAIAIn scope: the app and the public API. Out: partner systems.

DEV LEADAnd what do we pay?

ATALAIAA table by severity, published with the rules and the safe harbour.

Leaves the roomScope, rules, safe harbour, rewards

Step 2Start private

A small group of researchers before going public.

ATALAIATwenty-five researchers first. We learn the noise before going public.

RESEARCHERScope's clear. Starting on the redeem flow.

Leaves the roomPrivate: 25 invited researchers

Step 3Triage every report

Reproduced, deduplicated, ranked, then handed to the owner.

RESEARCHER 2Report: coupon codes are guessable. Six characters.

ATALAIAReproduced, not a duplicate. High, sent to the offers team.

RESEARCHERMine's a duplicate?

ATALAIAOf #42, yes. Here's when it was filed.

Leaves the room38 reports in, 9 valid

Step 4Close the loop

Fixed, retested, paid, and fed back into the line.

DEV LEADCodes are 16 characters now, and rate limited.

ATALAIARetested, fixed, paid. The case goes to QA and to the SOC.

Leaves the roomFixed, retested, paid in 14 days