Bug Bounty Program#
The Bug Bounty Program gives developers and security researchers full control over reporting security vulnerabilities, transmitting reports via RSA-encrypted channels, and tracking bounty rewards.
What Is the Bug Bounty Program?#
The Bug Bounty Program is a security hardening mechanism for the AuthVaultix platform.Researchers and developers can securely submit discovered security vulnerabilities on the platform using RSA end-to-end encryption. Once submissions are verified, rewards and recognition are granted according to the severity level.
Secure RSA Report Submission#
https://authvaultix.com/win/app/?page=bug-bounty
| Form Field | Data Type | Required | Description | Example |
|---|
| Severity | Select | Yes | The risk impact level of the vulnerability (low, medium, high). | high |
| Description | Textarea | Yes | A technical proof-of-concept description of the vulnerability (20 to 500 characters). | Authentication bypass vulnerability in API endpoint... |
| CSRF Token | Hidden String | Yes | A session protection token used to guard against cross-site request forgery. | csrf_8f9a0b1c... |
RSA End-to-End Encryption Security#
To preserve the confidentiality of reports, the backend encrypts the description payload with the RSA public key during submission processing.Database Protection: Raw plain-text reports are not stored in the database; only RSA-encrypted ciphertext is saved.
Private Key Decryption: Report content can only be decrypted by the AuthVaultix Security Team using the private key, ensuring absolute protection against data leakage.
Severity Tiers & Program Scope#
Reward Tiers#
High Severity: Critical authentication bypass, remote code execution (RCE), or unauthorized database access.
Medium Severity: Privilege escalation, CSRF flaws, or disclosure of sensitive information.
Low Severity: Minor security misconfigurations or low-risk logical glitches.
In-Scope vs Out-of-Scope#
In-Scope: AuthVaultix REST APIs (/api/1.0/), developer dashboard endpoints (/win/app/), and client SDK cryptographic key exchange.
Out-of-Scope: Automated vulnerability scanner reports, social engineering attacks, and denial-of-service (DDoS/DoS) attempts.
Tracking Submitted Reports#
You can track the status of submitted reports live in the dashboard table:Severity Badge: The selected risk level (High, Medium, Low).
Submission Timestamp: The date and time the report was submitted.
Review Status: The current triage phase (Pending Review, Verified, Reward Awarded).
