For organizations
Hear about your vulnerabilities from the people who find them
Publish a clear policy and scope, receive structured reports in one place, and work each one through triage, fix and coordinated disclosure, with the researcher kept in the loop.
Disclosure program or bug bounty?
Both run on the same workflow. The difference is how you say thank you.
Vulnerability disclosure program
VDP · thanks and reputation
A public front door for security reports. You publish a policy, a scope and a commitment to respond; researchers who report valid issues are thanked publicly and earn reputation. No money changes hands.
- The right first step for any organization with something on the internet
- Turns surprise emails into structured reports with steps to reproduce
- Researchers are credited on your Thanks page and the leaderboard
Bug bounty program
Bounty · cash rewards
Everything a VDP does, plus rewards. You publish a reward range for each severity, and pay valid reports within it. Money attracts more researchers and more depth of testing.
- A public reward table: low, medium, high and critical
- Best once your team can triage and fix issues quickly
- Reputation and Thanks credits still apply on top of rewards
What the platform gives you
The pieces every program needs, already wired together.
Structured scope
Assets by type with testing instructions, bounty eligibility and maximum severity, an exclusions table, and a CSV export for researchers’ tools.
Triage workflow
New, needs more info, triaged, resolved, or closed as duplicate, informative, not applicable or spam. Every change is logged in the thread, next to internal notes the reporter never sees.
Severity and weakness
Rate each report by severity or with a CVSS 3.1 vector, classify it by weakness (CWE), and record CVE ids when you assign them.
Response targets
Set targets for first response, triage and resolution. Your averages and response efficiency are shown on your program page.
Coordinated disclosure
Either side can ask to disclose a closed report. You choose full or limited disclosure and can write the public summary.
Hacktivity
A public feed of your resolved and disclosed reports that shows researchers your program is alive and responsive.
Thanks page
Researchers ranked by the reputation they earned on your program, with a public profile behind every name.
Safe harbor and updates
Publish a safe harbor statement that tells researchers what you authorize, and post program updates when your scope or rules change.
Launching a program
From first conversation to first report, in five steps.
Step 1: Get in touch
Tell us who you are, what you want tested and whether you want a VDP or a bounty program.Step 2: Draft the program
Write the policy, list the assets in scope and the exclusions, set response targets and, for a bounty, the reward table. Drafts are visible only to the program team.Step 3: Open it
The program appears in Opportunities and starts accepting reports. You can pause or close it at any time.Step 4: Respond and fix
Triage each report, keep the reporter informed in the thread, and resolve it once the fix ships.Step 5: Disclose and thank
Agree on disclosure when you are ready. Reporters of resolved issues appear on your Thanks page.
Talk to the team
Programs on root-me.cloud are created by the platform team. A contact address for new organizations has not been published yet, so check back soon. Meanwhile, see how live programs present their policy and scope.
Contacted by a hacker?
Someone found a security problem in your website or product and told you about it. That is good news: you heard it first. Here is how to handle it well.
Step 1: Reply and say thank you
Acknowledge the message quickly, even before you have confirmed anything. Silence is what pushes reporters to go public.Step 2: Ask for the details
Ask for the affected URL or version, steps to reproduce and any data they accessed. Ask them to keep it private while you investigate.Step 3: Verify and fix
Reproduce the issue, assess its impact and fix it. Give the reporter a rough timeline, and tell them if it slips.Step 4: Do not threaten
Legal threats against someone who reported in good faith rarely help and often make the problem public. Get advice if you need it, but treat the reporter as a partner.Step 5: Close the loop
Tell them when it is fixed, credit them if they wish, and agree together whether and when it can be discussed publicly.Step 6: Make the next report easier
Publish a disclosure policy with a security.txt file pointing to it, or launch a program here.
When it is not good faith
Asking whether you offer rewards is normal. Making payment a condition for sharing the details, or threatening to publish or sell the issue unless you pay, is extortion. Keep a record of the messages, do not pay under pressure, and involve your legal counsel or the police. Still fix the vulnerability.
Do we have to pay researchers?
Not with a vulnerability disclosure program: researchers are thanked publicly and earn reputation. A bug bounty program pays rewards from a table you publish, per severity. You set the amounts.
Who triages the reports?
The program team, in the platform’s report workflow: validate, ask for more information, rate the severity, mark duplicates, resolve. Programs labelled “Managed” are triaged by the platform team on the organization’s behalf.
Does anything about our reports become public?
A report’s details stay private until you and the reporter both agree to disclose it. You then choose full disclosure, or limited disclosure that publishes only the title, the metadata and a summary you write.
When a report is resolved, Hacktivity shows a one-line entry with your program, the reporter’s username and the date, without the title or any details.
Can we prepare the program before it goes live?
Yes. A new program starts as a draft that only the program team can see. Open it when the policy and scope are ready. Later you can pause it (still public, not accepting reports) or close it (kept as a public archive).
What should our policy contain?
An introduction, the assets in scope with their instructions and maximum severity, what you will not accept, rules of engagement, your response targets and a safe harbor statement. Post an update whenever any of it changes.
How is response efficiency calculated?
It is the share of reports that received a first response within your target, 3 days unless you set your own. Reports still waiting after the target count against it.
What about safe harbor?
Every program has a safe harbor page: use the platform’s default statement or write your own. Programs that commit not to pursue good-faith research within their policy are labelled “Full safe harbor”.
Give the people who find your bugs a better way to tell you
Start with a disclosure program. Add rewards when you are ready.