Recorded Future Public Managed Bug Bounty Engagement
Bounty Range
$250 - $5,000
external program
Recorded Future Public Managed Bug Bounty Engagement
Bounty Range
$250 - $5,000
external program
Welcome to the Recorded Future Bug Bounty program! No technology is perfect, and Recorded Future believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck and happy hunting!
For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
| Priority | Reward |
|---|---|
| P1 | $5000 |
| P2 | $2000 |
| P3 | $750 |
| P4 | $250 |
Testing is only authorized on the targets listed below. Any domain/property of Recorded Future not listed in the targets section is out of scope. This includes any/all subdomains not listed below. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Recorded Future, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation.
Credentials will not be provided for this engagement, however where accounts can be self-provisioned. When registering for an account, please sign up for an account using your @bugcrowdninja.com email address.
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
This engagement follows Bugcrowd's standard disclosure terms. Vulnerabilities found in this engagement requires explicit permission by selecting the disclosure request option on your submission.