Rules of Engagement
We welcome detailed, reproducible reports that help us keep the Appcharge platform secure. Please read and follow these guidelines before submitting.1. What to Include in Your Report
Submit the form below and be as specific as possible. A report without a working proof of concept (PoC) will be closed as Informational.- URL or product where the issue occurs
- Bug category (e.g., XSS, IDOR, logic flaw)
- Step-by-step reproduction and validation steps
- Impact assessment – why this matters and what harm it could cause
- Your remediation suggestions
2. Testing & Conduct Guidelines
| Do | Don’t |
|---|---|
| Use only your own Appcharge test accounts. | Modify, delete, or exfiltrate data that isn’t yours. |
Limit automated tools to ≤ 15 requests/sec and set your User-Agent to appcharge-bugbounty-your-email@. | Run brute-force, denial-of-service, or resource-exhaustion attacks. |
| Probe our services responsibly. | Target Appcharge employees, customers, or facilities (no social engineering, phishing, or physical intrusion). |
Heads-up: Scans with high QPS trigger automatic blocks. Reinstatement can take time, so please configure it correctly.
3. After You Send the Bug Bounty Report
- You’ll receive an automated acknowledgment (and a request for extra details if needed).
- Our security team reviews and attempts to reproduce your report.
- If validated, we’ll confirm the finding, prioritize a fix, and update you on bounty eligibility.
Rewards & Severity
We align our payouts with the CVSS 3.1 severity scale. While the ranges below show the maximum typical reward for each level, final amounts are always at Appcharge’s discretion. Exceptional, well-documented findings may earn a bonus, while issues with onerous preconditions or strong compensating controls may be reduced.| Severity | Reward (USD) |
|---|---|
| Critical | $1,000 – $2,000 |
| High | $800 |
| Medium | $500 |
| Low | $100 |
- The first fully reproducible report wins the bounty.
- Several bugs stemming from one underlying flaw are treated as a single vulnerability (one payout).
We award bounties upon validation and keep you in the loop as we work through remediation. Some cases require extra analysis—if so, payment may follow a bit later.
Payment Options
We may choose to use one of these two ways to provide your bounty:- PayPal – We’ll transfer the funds to your personal account. (You’ll need to confirm the account details belong to you.)
- Amazon Gift Card – We can email you an Amazon gift card for the full reward amount.