Gerobug is committed to the security of our users and services. We value the contributions of the security research community and look forward to working with you to protect our ecosystem. Below are the terms governing our Bug Bounty Program.

1. Program Eligibility & Rules of Engagement

• Acceptance of Terms: Participation is contingent upon full adherence to these terms and the policies listed on the Gerobug Bug Bounty portal.
• Authorized Channels: All reports must be submitted exclusively via the official portal. Direct contact with Gerobug staff via personal channels (social media, personal email) regarding bounties is prohibited and may result in disqualification.
• Testing Authorization: Research must be conducted solely on accounts you own or have explicit permission to access.
• Data Protection: You must not access, modify, exfiltrate, or destroy data belonging to other users. If you inadvertently encounter user data, stop testing immediately and note this in your report.
• Scope Adherence: Strict adherence to the "In Scope" and "Out of Scope" assets defined below is required.

2. Rewards & Valuation

• Risk-Based Assessment: Gerobug employs a risk-based approach to determine severity, referencing standards such as the OWASP Risk Rating and CVSS. We reserve the sole right to determine if an issue presents a valid security risk.
• Bounty Discretion: Reward amounts are determined based on impact, complexity, ease of exploitation, and report quality. Past rewards for similar issues do not guarantee future amounts.
• Duplicate Reports: In the case of duplicate submissions, the first valid report received is eligible for the reward. Gerobug determines duplicate status and is not obligated to share details of the original report.
• Response Service Level: We aim to acknowledge reports within 3 business days. However, triage prioritization is based on risk severity.

• *.gerobug.com (All subdomains)
• *.gerosecurity.com (All subdomains)

• Third-party applications, plugins, or microsites (e.g., WordPress, hosted blogs, external CMS).
• Social Engineering (e.g., phishing, vishing, smishing).
• Physical security attacks or facility access.
• Denial of Service (DoS/DDoS) or resource exhaustion attacks.
• Self-XSS without a valid vector to affect other users.
• Automated scanning traffic without a specific, validated proof of concept.

Safe Harbor & Disclosure Policy

We consider security research conducted in accordance with this policy to be "authorized." We will not pursue legal action against researchers who adhere to these guidelines:

• Good Faith Research: You agree to act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services.
• Confidentiality: You must not exploit a security flaw beyond the minimal steps necessary to prove its existence. Accessing or exfiltrating PII (Personally Identifiable Information) is strictly prohibited.
• Embargo Period: You agree to withhold public disclosure until Gerobug has verified and remediated the issue.
• Public Disclosure: You may publish your findings only after receiving explicit written approval from the Gerobug team. Typically, this is allowed 90 days after remediation, though critical severity issues may require a longer embargo to ensure user safety.
• Compliance: You must not violate applicable laws or regulations, including those regarding unauthorized data access.

• Proof of Concept (PoC): Reports must include clear, reproducible steps. We prefer text-based steps or scripts (e.g., HTTP requests, curl commands) over video/screenshots alone. If a video is necessary for complex reproduction, please include it via a private link.
• Impact Analysis: Clearly articulate the security impact. Describe the specific scenario: Who is the victim? What can the attacker gain?
• Remediation: Including suggested fixes or mitigation steps is highly appreciated and demonstrates a deeper understanding of the issue.
• Incident Reporting: If you unintentionally access sensitive data or disrupt a service during testing, you must cease testing immediately and disclose this incident within the report.

Q: I found a vulnerability, but I can't exploit it. Is it eligible?

A: We generally require a valid attack scenario to qualify for a reward. Theoretical vulnerabilities without a proven impact are typically ineligible. However, if you provide new information (such as chaining multiple minor bugs to achieve a critical impact), the panel is happy to re-evaluate the submission.

Q: Who determines eligibility and bounty amounts?

A: The Gerobug Security Team serves as the final decision-making panel for all rewards, severity assessments, and eligibility criteria.

Q: When will the bounty be paid?

A: Bounties are processed after the vulnerability has been validated and remediated. Please allow up to 90 days for the payment process to complete.

Q: Can I publicly disclose my findings?

A: We support transparency but require strict adherence to our Safe Harbor & Disclosure Policy. You must allow us reasonable time to remediate the issue before any public release. Reports published without prior authorization or before the embargo period ends will be disqualified, and the researcher may be barred from future participation.