Bug Bounty Program

UPVED protects the personal information of the donors, volunteers, and community members who support our environmental work. We welcome help from the security research community and pay rewards for valid vulnerabilities reported under the rules on this page.

Program type

Self-hosted, public, paid bug bounty

Launch date

October 10, 2025

Last updated

February 20, 2026

Rewards

USD $50 – $2,500 per valid, eligible report

Contact

[email protected]

In scope

• https://upved.org
• https://www.upved.org
• Any other *.upved.org subdomain operated directly by UPVED

If you are unsure whether an asset belongs to UPVED, email [email protected] before testing it.

Out of scope

• Third-party services we use but do not operate (for example Stripe, Vercel, email providers, and social media platforms). Report those to the vendor's own program.
• Denial-of-service or volumetric attacks, and findings that require them
• Social engineering, phishing, or physical attacks against UPVED staff, volunteers, donors, or facilities
• Missing security headers, cookie flags, or SPF/DKIM/DMARC settings without a demonstrated exploit
• Clickjacking on pages with no sensitive actions
• Self-XSS, logout CSRF, and CSRF on forms that change nothing sensitive
• Rate-limiting or brute-force issues on non-authentication endpoints
• Version disclosure, banner grabbing, or descriptive error messages without further impact
• Reports generated only by automated scanners without a validated proof of concept
• Vulnerabilities in outdated browsers or rooted/jailbroken devices
• Issues already known to us or already reported by another researcher

Rewards are paid in US dollars. Severity is based on CVSS v3.1 and adjusted for the real impact on UPVED and the people whose data we hold. The final severity and reward amount are decided by UPVED.

Payment terms

• Only the first researcher to report a given vulnerability is eligible. Duplicates are decided by the time we receive the report.
• Several reports with the same root cause are treated as one report and receive one reward.
• Rewards are paid within 30 days of the report being validated, by bank transfer or PayPal.
• You are responsible for any taxes on your reward. US researchers receiving $600 or more in a calendar year must provide a Form W-9; non-US researchers must provide a Form W-8BEN.
• We cannot pay researchers in countries or on lists subject to US sanctions (including OFAC lists), or where payment is otherwise prohibited by law.
• You may ask us to donate your reward to an environmental charity of your choice instead.

To qualify for a reward and for safe harbor, you must:

• Test only the in-scope assets listed above.
• Use only accounts you created yourself. Never access, change, or delete data belonging to other people. If you reach personal data by accident, stop, do not keep a copy, and tell us in your report.
• Do only what is needed to prove the vulnerability. Do not pivot to other systems, keep access, or plant backdoors.
• Keep automated traffic to no more than 5 requests per second, and stop at once if you see any impact on site availability.
• Do not make real donations or payments to test payment flows, and do not submit fraudulent forms or newsletter sign-ups that send email to other people.
• Do not disclose the vulnerability publicly or to anyone else until we have fixed it and agreed to disclosure.
• Follow all applicable laws.

Eligibility

• You must be at least 18 years old, or have written permission from a parent or guardian.
• Current and former UPVED employees, board members, contractors, and volunteers with system access in the past 12 months are not eligible for rewards, nor are their immediate family members.

Email your report to [email protected] with the subject line starting [Bug Bounty]. Please include:

• A short description of the vulnerability and its impact
• The affected URL, parameter, or component
• Step-by-step instructions to reproduce it
• A proof of concept (screenshots, video, or request/response pairs)
• Your suggested severity and any suggested fix
• The name or handle you would like credited, if any

Our response targets, in business days:

• Acknowledge your report: within 3 days
• Triage and confirm severity: within 10 days
• Fix Critical and High issues: within 30 days of triage
• Fix Medium and Low issues: within 90 days of triage

We will keep you updated on progress until the issue is resolved.

If you make a good-faith effort to follow this policy, UPVED considers your research authorized. We will not pursue legal action against you or report you to law enforcement, including under the Computer Fraud and Abuse Act (CFAA), the DMCA, or similar laws, for research done under this policy.

If a third party takes legal action against you for research done under this policy, we will make it known that your actions were authorized by us. If you are unsure whether a planned test follows this policy, ask us first at [email protected].

We follow coordinated disclosure. Once an issue is fixed, we will work with you on the timing and content of any public write-up. If we have not fixed a valid issue within 90 days of your report, you may ask us to agree a disclosure date, and we will not refuse without good reason.

With your permission, we will credit you by name or handle on this page once the issue is resolved.