VDPBug bounty
Find a hole.
We'll make it worth it.
Security teams trust us with their investigations, so our own security has to hold. If you find a vulnerability in Muswa.com, report it privately. Critical and high findings earn a cash reward, lower severities earn free plan time, and every valid researcher gets credit.
Severity & rewards
CVSS v3.1 as a guide, final call on real impactCritical
CVSS 9.0 – 10.0
Remote code execution, auth bypass to any account, reading other users' lookups or billing data at scale
Cash reward
At our discretion
High
CVSS 7.0 – 8.9
Account takeover with user interaction, SSRF reaching internal services, stored XSS in the dashboard, quota or payment bypass
Cash reward
At our discretion
Medium
CVSS 4.0 – 6.9
CSRF on a state-changing action, IDOR leaking limited metadata, user enumeration through a flow
3 months Professional
Free plan time
Low
CVSS 0.1 – 3.9
Minor information disclosure, missing security control with limited exploitability
1 month Basic
Free plan time
Cash amounts are decided case by case, based on impact, quality of the report and how far the issue could reach. Plan time is added to your account and stacks with any active subscription.
01Scope
What you can test
Anything we build and run ourselves is fair game. If you are unsure whether a target belongs to us, ask first at [email protected].
assets in scope
exclusions
day disclosure
| Asset | Type | Notes |
|---|---|---|
| muswa.comMarketing site, dashboard, account and settings pages | Web app | Marketing site, dashboard, account and settings pages |
| muswa.com/api/v1/*Public API authenticated with API keys | REST API | Public API authenticated with API keys |
| muswa.com/mcpTool server used by AI assistants | MCP endpoint | Tool server used by AI assistants |
| Auth flowsRegister, login, reset, email change, sessions | Logic | Register, login, reset, email change, sessions |
| Billing flowInvoice creation, plan activation, quota accounting | Logic | Invoice creation, plan activation, quota accounting |
Out of scope
- Third-party services and providers
- Denial of service, volumetric or load testing
- Social engineering, phishing of staff or users
- Physical attacks on offices or data centres
- Missing best-practice headers with no demonstrated impact
- Self-XSS or attacks that need a victim to paste code
- Rate limits missing without a security impact
- Clickjacking on pages with no sensitive action
- Raw output of automated scanners, with no verified impact
- AI-generated or AI-written vulnerability reports
- Software version disclosure, banner grabbing
- Email SPF/DMARC configuration reports
- Vulnerabilities in outdated browsers only
02Rules of engagement
Play fair, get paid.
- 01
Use your own accounts
Test only against accounts you own or have explicit permission to use. Never access, change or delete other users' data; stop and report as soon as you see it.
- 02
Stay gentle
No automated scanning above a few requests per second, no fuzzing that degrades service, no spam through our forms.
- 03
Spend lookups, not upstreams
Do not use the platform to attack third parties or to hammer our data sources. Your findings must be about Muswa.com itself.
- 04
Keep it private
Do not disclose a finding publicly until it is fixed and we agree on a date. We aim for coordinated disclosure within 90 days.
- 05
One issue, one report
Chained bugs go in one report. Duplicates are credited to the first valid report we receive.
- 06
No extortion
Reports that come with demands or deadlines before triage are not eligible and may be reported.
- 07
Human research only
We reward real human work. Reports that are AI-generated, AI-written or AI-redacted, and the raw output of automated scanners, do not qualify — if a submission reads as model output or an unverified scan, we close it without a reward.
Safe harbour
If you act in good faith and follow these rules, we consider your research authorised. We will not pursue legal action against you, will not report you to law enforcement, and will help if a third party does.
This covers circumvention of security controls to the extent needed to show the issue, and we waive restrictions in our Terms of Service that would otherwise forbid that testing. Safe harbour does not apply to activity that breaks the rules above, harms users or data, or violates the law of your own country. — MUSWA
03How to report
Email [email protected]
One report per issue, written in English. Start the subject with [Security] so it skips the support queue.
Subject: [Security] <short title> — <severity guess> Summary: One or two sentences on the issue and its impact. Affected asset: URL / endpoint / flow (e.g. POST /api/v1/...) Steps to reproduce: 1. 2. 3. Proof of concept: Requests, responses or a short video. Redact any real user data. Impact: What an attacker could achieve. Your account email (for the reward): Credit name (optional):
04What happens next
Our commitments
- 2First step
Acknowledgewithin 2 business days
A human confirms receipt and gives you a reference.
- 7
Triagewithin 7 days
We reproduce, set severity and tell you the outcome.
- 30
Fixwithin 30 days
Target for critical and high. Lower severities follow.
- 90
Disclosewithin 90 days
Coordinated publication, with credit if you want it.
Hall of thanks. With your permission, we credit every valid finding on this page once it is fixed. The list opens with the first accepted report.