Bug Bounty Programme

Reward Tiers

Rewards are based on the CVSS v3.1 score and confirmed business impact of the vulnerability.

Critical

₹50,000

CVSS 9.0–10.0

High

₹20,000

CVSS 7.0–8.9

Medium

₹8,000

CVSS 4.0–6.9

Low

₹2,000

CVSS 0.1–3.9

Exceptional reports with novel attack chains or significant business impact may receive additional bonus rewards at our discretion. All rewards are subject to tax withholding as required by Indian law.

Scope

Target	Status	Reward Eligible
isecintel.com	In Scope	Yes
*.isecintel.com (all subdomains)	In Scope	Yes
ISec Intel mobile apps	In Scope	Yes
ISec Intel internal tools (if accessible)	In Scope	Yes — bonus
Third-party SaaS we use	Out of Scope	No
Client environments	Strictly OOS	No

Qualifying Vulnerabilities

Remote code execution (RCE) — immediate Critical reward
Authentication bypass or privilege escalation
SQL injection with data access demonstrated
Stored XSS on authenticated pages
SSRF with internal network access
Sensitive data exposure (PII, credentials, business data)
Insecure direct object references (IDOR) with user data impact
Business logic flaws with financial or security impact

Non-Qualifying Reports

Issues requiring physical access to devices
Social engineering of ISec Intel employees
Clickjacking on informational pages
Missing security headers without exploitation path
SPF/DKIM/DMARC issues without demonstrated impact
Automated scanner output without manual validation
Previously known issues already in our tracker
Vulnerabilities in out-of-scope assets

Submission Process

Email bugbounty@isecintel.com with subject: [Bug Bounty] [Severity] — Brief Description
Include full reproduction steps, screenshots, and PoC code
Provide your PAN card details for reward payment (Indian researchers)
For international researchers: provide bank wire details
One report per vulnerability — do not submit duplicates
Allow 90 days for remediation before public disclosure

Hall of Fame

Valid findings are credited in our Security Hall of Fame with the researcher's permission. Top contributors are featured on our LinkedIn page and may be invited to participate in private programmes.

Our Hall of Fame will be published once the programme receives its first valid submissions. Be the first to claim your spot.

Rules

Do not access user data beyond what is needed to demonstrate the vulnerability
Do not perform destructive testing or denial of service
Do not access other researchers' findings in our tracker
Comply fully with our Responsible Disclosure Policy
Only one researcher may claim the reward per vulnerability (first valid report wins)

Violation of these rules will result in disqualification and may result in legal action.

BUG BOUNTYPROGRAMME