← All policies
Legal policy

Bug Bounty Program

Learn how security researchers can report eligible Smackdab vulnerabilities, follow testing rules, and qualify for review.

Last updated: November 22, 2025 Official PDF 5 sections
Download official policy ↓
← All policies
Official policy available. This page is a web-formatted version for readability. If anything conflicts, the official policy controls. Download PDF

SMACKDAB BUG BOUNTY PROGRAM

Effective Date: 09/27/2026

Last Updated: 09/27/2026

Version: 2.0

The Smackdab Bug Bounty Program has relaunched on its own site: bounty.smackdab.ai. Vulnerability reports are accepted only there; we do not accept reports by email.

Document Location: https://smackdab.ai/legal/bug-bounty-program

1. Where the program lives

Everything about the program is at bounty.smackdab.ai:

  • Program rules – the binding terms: eligibility, rules of engagement, grading, rewards, payments, disclosure and safe harbor. Every version is kept, and you accept the current one when you join.

  • Scope – which assets are in scope for rewards.

  • Known issues – everything we already know about, by category and area, with the date it was claimed. Details are published after the fix and the disclosure window.

  • Join or sign in – create a researcher account with your email; submit reports, follow their status, talk with our team and track payouts.

  • Hall of fame and public ledger – credit for researchers, and a tamper-evident, timestamped record of when every report and known issue arrived, so priority can be checked by anyone.

If anything on this page differs from the rules on bounty.smackdab.ai, the rules there govern.

2. The program in brief

  • Rewards: Critical 100–300 USD, High 50–150 USD, Medium 25–75 USD, Low recognition only. The amount within a range comes from a published rubric (impact, exploitability, proof quality, cooperation). No working proof, no reward.

  • One reward per root cause, to the first reporter. Reports are checked against earlier reports and known issues as they arrive. If the same mistake shows up in several places, list them all in one report.

  • Monthly reward pool: rewards are paid from a published monthly pool of 1,200 USD. If a month’s pool is used up, approved rewards are paid the next month in the order they were approved.

  • Payments: PayPal, in US dollars. Before payment you set up two-step verification, confirm your PayPal email and give your legal name and country; everyone is screened against US sanctions lists. Tax form requirements are set out in the rules.

  • Our AI helps triage. Claude, our AI assistant, helps compare and review reports, and a person makes every reward decision and every rejection other than a proven duplicate.

3. Relationship to other policies

This program sits alongside our Responsible Disclosure Policy (VDP), which covers reporting any vulnerability in its in-scope systems, including ones that are out of scope for rewards, and our Security Policy and other legal agreements.

4. Contact

Report every vulnerability at bounty.smackdab.ai; we do not accept vulnerability reports by email, and reports sent by email are not reviewed. Questions about the program only: [email protected].