1. Who pays the reward
Rewards are offered by the organization that operates the relevant security program. The organization defines the program's reward eligibility criteria, available reward ranges, exclusions and applicable conditions.
Proofsec provides a platform for security research and coordination. A reward is not guaranteed merely because a researcher uses Proofsec, submits a report or receives a particular platform status.
The organization responsible for the program determines whether a report qualifies for a reward and the amount payable under its published rules. The organization remains responsible for ensuring that its reward commitments are accurate and appropriately funded.
Proofsec may provide platform functionality that supports reward administration or payment workflows as those features become available. The exact payment flow depends on the functionality implemented for the relevant program.
Proofsec's use of Stripe for payment-related functionality does not, by itself, mean that Proofsec receives, holds, pools or forwards every reward. The roles of Proofsec, the organization, Stripe and the researcher depend on the actual payment arrangement.
No Proofsec platform fee or deduction from a researcher's reward is promised or implied by this document. Any fee, deduction or currency-conversion charge that applies must be disclosed through the relevant program terms or payment flow before the researcher relies on the stated amount.
2. Reward eligibility
A reward is available only when the relevant program offers one and the submitted finding satisfies the program's published eligibility requirements.
Unless the program states otherwise, the following conditions are relevant to reward eligibility:
- The affected asset was in scope when the relevant testing was conducted.
- The research complied with the program's Rules of Engagement and applicable testing restrictions.
- The report describes a genuine security issue supported by sufficient evidence.
- The finding is reproducible or can otherwise be validated by the organization.
- The issue meets the program's vulnerability and impact criteria.
- The report is not excluded as a duplicate, known issue or other category under the program's published rules.
- The researcher satisfies applicable participation, age, identity-verification and payment requirements.
- The researcher provides information reasonably necessary to process an eligible reward, subject to applicable data protection requirements.
- These conditions are general guidance rather than a replacement for the rules of an individual program. A program may establish additional requirements or exclusions, which should be communicated before research begins.
- A technically valid finding may not qualify for a reward if it falls outside the program's published eligibility conditions. Researchers should review those conditions before testing.
3. Program reward ranges and conditions
Each organization is responsible for publishing accurate reward information for its program, including available reward ranges, eligible vulnerability classes, exclusions and any special conditions.
A published range indicates the potential reward for eligible findings under the program's rules. It does not guarantee a particular payment or mean that every report within a vulnerability category receives the maximum amount.
Before beginning research, review the current program description and any additional reward conditions. If an amount, eligibility rule or payment condition is unclear, request clarification through the program's designated communication channel.
The program's applicable terms at the time of testing and submission may be relevant to a reward decision. Researchers should retain a reasonable record of the published conditions that applied to their work.
An organization should communicate material changes to reward terms clearly. The effect of a change on reports already submitted or research already performed depends on the program's terms, applicable agreements and law.
4. How the reward amount is determined
The organization responsible for the program determines the reward amount in accordance with its published criteria and available reward range.
Severity may be classified using categories such as low, medium, high or critical. Where appropriate, an organization may also use CVSS or another documented severity methodology.
Severity and reward amount are related but distinct. A severity classification does not automatically establish a specific payment, and two findings with similar classifications may receive different amounts under a program's rules.
Relevant factors may include the realistic security impact, affected assets, exploitability, required privileges, prerequisites, scope of affected users or systems and the quality of the evidence.
The researcher may suggest a severity and explain the reasoning, but the organization may reach a different assessment based on its evaluation and published methodology.
Where the program provides for explanations or review of reward decisions, the researcher may use that process to ask questions or challenge an assessment. A review request does not guarantee a different severity or reward amount.
5. Validation and report outcomes
Submitting a report does not guarantee acceptance, a reward or a particular payment date. The organization may need to reproduce the issue, request additional evidence, assess severity and determine whether the finding is eligible.
An accepted report generally means that the organization has determined that the submission meets its acceptance criteria. It does not necessarily mean that a reward has been approved, processed or paid.
A report that requires more information may need further reproduction steps, technical evidence or clarification before the organization can make a decision.
A rejected or informative report may be ineligible for a reward under the program's terms. A duplicate may also be ineligible, subject to the program's duplicate policy.
Researchers should read the outcome and the program's explanation carefully. If the decision appears inconsistent with the published terms or overlooks material evidence, use the available review or communication process.
6. Duplicates and previously known issues
Programs may exclude duplicate reports or issues already known to the organization. The applicable program determines how duplicate status is assessed and whether any exception applies.
Two submissions may be duplicates when they describe the same underlying weakness, even if the wording, reproduction steps or affected endpoints differ. Similar symptoms may nevertheless result from different root causes, so the technical circumstances matter.
The organization determines whether a report is a duplicate under its program rules. Proofsec does not guarantee that every duplicate can be detected automatically or that timestamps alone establish priority.
Reports, evidence and submission times may be relevant to an organization's review where they are available and appropriate to use. The precise method of duplicate detection depends on the actual workflow and available records.
Researchers should not attempt to access another person's private report or an organization's internal records to establish who reported an issue first.
If a report is marked as a duplicate and the researcher believes it describes a materially different vulnerability or impact, the researcher may explain the distinction through the available review process.
7. Informational and out-of-scope findings
Informational reports may describe useful observations that do not meet the program's criteria for a reward-eligible vulnerability. Examples can include hardening recommendations without demonstrated security impact or behaviors expressly excluded by the program.
Out-of-scope findings concern assets or testing activities that are not covered by the applicable authorization. Researchers must not assume that an out-of-scope finding becomes eligible for a reward simply because it appears technically significant.
Informational and out-of-scope findings are generally not reward-eligible unless the program's published terms explicitly provide otherwise.
The exact classification depends on the program's criteria and the facts of the report. Researchers should avoid presenting speculative impact as confirmed evidence.
8. Reward allocation for squads and collaboration
Researchers who collaborate on a finding should discuss attribution and the intended reward allocation before beginning joint work whenever possible.
A team should clearly establish who is participating, how contributions will be recognized and how any reward will be divided if the program accepts the report.
Where a supported Proofsec workflow records a reward split for a session or report, the participants should review that record and ensure it reflects their agreement before relying on it.
The availability and legal effect of a platform-recorded split depend on the implemented functionality, the relevant agreement and applicable law. This policy does not guarantee that every session has a reward-splitting feature.
If no supported split has been recorded, the participants should not assume that the platform will automatically calculate or enforce a particular allocation.
A reward split agreed between researchers does not change the organization's total reward obligation unless the organization separately agrees to a change.
Team members should preserve relevant communications and contribution records if a disagreement arises, while avoiding unnecessary disclosure of confidential research material.
9. Disputes between collaborators
Disagreements may arise over authorship, contributions, attribution or the division of a reward. Researchers should first attempt to resolve these matters through clear, good-faith communication.
The team should refer to any applicable written agreement and the reward allocation recorded through a supported platform workflow, where one exists.
Proofsec may provide communication or administrative features that help participants clarify a dispute, depending on the functionality available. This document does not promise that Proofsec will arbitrate every disagreement or determine the legal ownership of a reward.
Where a payment is subject to a genuine dispute, the organization or payment provider may need to assess the applicable terms before the disputed amount can be processed. Any delay, hold or restriction must have an appropriate basis in the relevant arrangement and applicable law.
Researchers must not use threats, harassment, unauthorized access or public disclosure of confidential findings to pressure teammates into accepting a split.
10. Payment methods and processing
The payment method, supported countries, currencies, processing requirements and expected timing depend on the reward program and the payment arrangement used by the organization.
Proofsec uses Stripe for payment-related functionality where that integration is enabled. The exact payment services available for a particular program depend on the deployed integration, the parties involved and the applicable Stripe terms.
Not every payment method, country or currency is necessarily supported. Researchers should review the instructions presented for the relevant reward before providing payment details.
Payment processing may require the researcher to provide accurate payment information, complete identity verification or supply other information required by the payment provider or applicable law.
Proofsec does not guarantee a universal payout schedule. Processing time may depend on the organization approving the reward, the payment provider, verification requirements, banking systems, currency conversion, weekends, public holidays or other circumstances outside the platform's control.
A payment marked as pending, initiated or processing should not be treated as completed until the relevant payment flow confirms the outcome.
11. Payment information and verification
Researchers should provide accurate information through the payment flow designated for the relevant program. Incorrect, incomplete or inconsistent details may delay or prevent a payment.
Depending on the payment method and applicable requirements, a payment provider or organization may request identity, residency, tax or other verification information.
Only provide requested information through an appropriate, trusted channel. Do not post identity documents, banking details, payment credentials or tax identifiers in public profile fields, public discussions or vulnerability reports.
Stripe or another relevant payment provider may independently process personal data under its own legal obligations and privacy terms. The exact information required depends on the payment service and jurisdiction.
Proofsec should request or receive only the information reasonably necessary for its role in the payment workflow and should handle that information in accordance with applicable data protection requirements.
12. Failed, delayed or returned payments
A payment may be delayed, rejected, returned or otherwise fail because of inaccurate payment details, incomplete verification, provider restrictions, banking issues, compliance checks or technical problems.
If a payment does not arrive within the timeframe indicated by the relevant payment flow, review its current status and contact the designated program or support contact with the relevant transaction reference.
Do not send full payment credentials, passwords or unnecessary financial information in a support message. Provide only the details needed to identify the transaction safely.
A failed payment may require updated information, additional verification or a different supported payment method. Whether a payment can be retried depends on the payment provider and the organization's arrangements.
A payment issue does not automatically invalidate the underlying accepted report or reward entitlement. The applicable program terms and facts determine the parties' obligations.
13. Currency conversion and fees
Rewards may be quoted or paid in a currency specified by the relevant program. The currency in which a researcher ultimately receives funds may differ if the payment method or receiving account uses another currency.
Currency conversion rates, banking charges, payment-provider fees and intermediary charges may affect the amount ultimately received, depending on the payment route.
Any fee or deduction charged by Proofsec, the organization or a payment provider should be disclosed where required and before the researcher is expected to rely on the stated net amount.
This document does not establish a fixed exchange rate, guarantee that transfers are fee-free or specify a universal payment currency. Review the applicable program and payment information for the actual terms.
14. Taxes and legal responsibilities
Rewards may have tax or reporting consequences depending on the researcher's country of residence, tax status, the nature of the payment and applicable law.
Researchers are responsible for understanding and meeting their own tax obligations to the extent required by applicable law. These obligations may include reporting income, maintaining records, filing declarations or paying taxes and social contributions where applicable.
An organization or payment provider may also have legal obligations concerning reporting, withholding, identity verification or recordkeeping. Such obligations depend on the applicable law and payment arrangement.
Proofsec does not provide individualized tax, accounting or legal advice through this document. Researchers who are uncertain about their obligations should consult a qualified professional or the relevant tax authority.
Keep appropriate records of reward decisions, payment confirmations and related correspondence for as long as necessary to meet applicable legal requirements.
15. Cancellations, reversals and adjustments
A reward decision or payment record may need to be reviewed if it was based on materially incorrect information, a duplicate determination changes, a transaction fails or an error is identified.
A payment reversal, cancellation or recovery must follow the relevant program terms, payment-provider rules and applicable law. This document does not create an unrestricted right to withdraw a reward that has already been validly paid.
If a reward amount or status changes, the relevant organization should provide an explanation through the available communication channel where appropriate.
Researchers should not attempt to bypass payment controls, create misleading transactions or obtain multiple payments for the same reward by manipulating reports or accounts.
16. Fraud and program abuse
Reward systems depend on truthful reports, reliable evidence and compliance with program restrictions. Fraud or deliberate abuse may affect reward eligibility and access to platform features.
Examples of prohibited conduct include fabricating vulnerabilities, falsifying evidence, knowingly misrepresenting impact, submitting another person's work as your own, manipulating duplicate handling, colluding to obtain improper rewards or attempting to exploit payment workflows.
Testing outside the authorized scope, accessing unnecessary sensitive data or violating a program's Rules of Engagement may also affect eligibility, depending on the facts and applicable terms.
Where there is a reasonable basis to suspect fraud or abuse, the responsible organization or platform operator may review the relevant records and take measures permitted by the applicable terms and law.
Possible measures may include requesting clarification, correcting a report outcome, declining an unpaid reward or restricting relevant functionality where there is an appropriate basis to do so.
Any cancellation, withholding, recovery or restriction must be assessed in context and must not be treated as an automatic penalty for every disputed or rejected report.
17. Reputation and rewards are separate
Proofsec reputation and financial rewards are separate concepts. Reputation is a platform signal associated with research activity and report outcomes; a reward is a payment governed by the applicable program terms.
An accepted report does not necessarily result in a payment, and receiving a reward does not automatically establish a particular reputation score.
Any effect of a report outcome on reputation depends on the platform's published rules and actual implementation. This document does not establish a numerical score increase or decrease.
A report decision, severity assessment, reward approval and payment confirmation may represent separate stages of the process.
18. Confidentiality and responsible communication
Reward discussions may involve confidential vulnerability details, internal program information or personal and payment data. Keep communications within the channels designated for the relevant report or payment issue.
Do not publish confidential evidence, personal information or sensitive technical details to pressure an organization or teammate into approving a reward.
When discussing a disputed decision, focus on the published criteria, relevant evidence and the specific point of disagreement.
Follow the program's disclosure policy and confidentiality obligations even if a reward is delayed, declined or disputed.
19. Changes to reward terms
Organizations may update program reward ranges, eligibility criteria, payment methods or other conditions as their programs evolve.
Researchers should review the current program terms before beginning new research and check relevant updates before relying on a potential reward.
The effect of an update on existing reports, previously completed research or an already approved reward depends on the applicable program terms, agreements and law.
Material changes should be communicated in a manner consistent with the program's rules and applicable legal requirements. A general update to this document does not by itself resolve every question about an individual reward.
20. Questions and reward disputes
For questions about eligibility, severity, duplicate handling or the amount offered for a report, use the communication or review process specified by the relevant program.
For a payment issue, provide the report reference or transaction reference where available and explain the issue clearly. Do not include unnecessary personal data or full payment credentials.
If a dispute concerns the division of a team reward, refer to the applicable team agreement and any supported reward allocation record.
Proofsec's role in reviewing or resolving a dispute depends on the platform functionality, the applicable terms and the parties involved. Contacting Proofsec does not guarantee that a decision will be changed or that Proofsec can resolve a dispute between other parties.
For general platform questions, contact contact@proofsec.net.
21. No guarantee of earnings
Participation in security research through Proofsec does not guarantee that a researcher will discover an eligible vulnerability, receive a reward or earn any particular amount.
Potential rewards depend on the program, the findings submitted, the applicable eligibility criteria, the organization's assessment and the terms governing payment.
Researchers should not incur expenses, make financial commitments or represent potential rewards as guaranteed income based solely on a program's published reward range.
22. Relationship with other terms
These Rewards and Payments Terms should be read together with the applicable program description, Rules of Engagement, platform terms, privacy information and any relevant agreement concerning team participation or payment.
If terms appear to conflict, do not assume that the interpretation most favorable to a payment is automatically controlling. The applicable agreements, program-specific provisions and relevant law determine the outcome.
Nothing in this document removes rights that cannot lawfully be excluded or limits mandatory protections under applicable law.
23. Effective status and updates
Proofsec is a platform project operated from Croatia, European Union, and has not yet been registered as a legal entity. The legally responsible contracting party and any formal payment arrangements must be identified through the applicable program terms and actual operating structure.
These terms describe general reward and payment principles. They do not claim that every described workflow, reward allocation feature, payment method or dispute mechanism is currently implemented.
This document may be updated as Proofsec develops its payment functionality, enters into service arrangements or changes its platform rules. The published version and applicable program terms should be reviewed before relying on a particular payment workflow.
24. Researcher checklist
- I have read the program's reward criteria, exclusions and Rules of Engagement.
- I understand that report acceptance does not guarantee a reward or immediate payment.
- I know which organization is responsible for offering the reward.
- I have checked the applicable severity and reward assessment criteria.
- If I am collaborating, I have discussed attribution and reward allocation with my teammates.
- I will use only the payment methods supported by the relevant program.
- I will provide accurate payment information through an appropriate channel.
- I understand that verification, payment-provider requirements, fees or currency conversion may affect processing.
- I will check my applicable tax obligations and keep appropriate records.
- I will use the available review process to raise a dispute and protect confidential information.