
Say Technologies
External Program
Submit bugs directly to this organization


External Program
Submit bugs directly to this organization
Welcome to the Say Technologies Bug Bounty Program! We’re excited to work more closely with you on discovering bugs in Say. If you have any questions on our program, please email [email protected] or find us on Bug Bounty Forum. Thank you for helping keep Say Technologies and our users safe!
By submitting reports to our program, you agree that you’ve read, understood, and will follow our Program Rules and overall Program Policy.
Violation of any of our Program Rules may result in (but is not limited to) ineligibility for a bounty and/or permanent disqualification and removal from Say Technologies’ and any of its affiliate’s bug bounty programs.
Say Technologies will use commercially reasonable efforts to meet the following SLAs for hackers participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First Response | 1 day |
| Time to Triage | 5 days |
| Time to Bounty | 1 day after triage |
Due to the nature of our business, we ask that you also follow these guidelines:
Say Technologies accepts zero-day issues in third party software that can be directly used to compromise the confidentiality or integrity of our products. Zero-day issues may be submitted to our program at any time; however, we will only accept reports that permit us to disclose the issue to the relevant vendors. We cannot authorize testing against any third parties or our vendors.
To be eligible to participate in the Say Technologies Bug Bounty Program, you must:
Our program calculates bounties for reports based on a sliding CVSSv3 scale, calculated by HackerOne; the higher the issue’s score, the higher your bounty will be. We’ll use lower environmental scores for assets that are less important to Say Technologies. We encourage rating your issues with CVSS before submission, but know that we may have to make adjustments in the event the score isn’t representative of the true impact. Final determination of the eligibility and severity of the issue will be made by and at the sole discretion of the Say Security Team.
Eligibility is limited to domains and properties owned and operated by Say Technologies. Software components used within Say Technologies are eligible and may be exploited in your vulnerability testing. Note that bugs in third-party components only qualify if we determine that they can be used to successfully exploit Say Technologies.
We consider most informative-type issues to be out of scope, like SPF issues. If most other bug bounty programs exclude it, we likely would too. To keep it brief, we’ll only enumerate the most important issues to avoid testing or reporting.
If you have any questions about the rules or scope of the Say Technologies Bug Bounty Program, please reach out to us at [email protected] or on Bug Bounty Forum.
Say Technologies LLC is a wholly-owned subsidiary of Robinhood Markets, Inc. © 2023 Robinhood Markets, Inc.