WhiteAds Terms for Bounty Hunters
By signing up or participating as a Bounty Hunter, you agree to comply with these “Terms for Bounty Hunters”, together with the applicable Terms and Conditions, Program Policy, Vulnerability Disclosure Mechanism, and any other policies or guidelines issued by the Company from time to time. These documents are incorporated into these Terms by reference.
a. Vulnerability Disclosure Mechanism
Before conducting any testing on a Customer’s Systems, the Bounty Hunter must review and agree to comply with the Vulnerability Disclosure Mechanism and any other applicable rules defined by the Company and/or the relevant Customer.
The Bounty Hunter must conduct all testing responsibly and strictly within the scope and limitations specified in the applicable Bounty Program and Program Policy.
b. Out-of-Scope Vulnerabilities
Bounty Hunters must not test:
- Assets that are expressly identified as out of scope;
- Vulnerabilities or testing methods that are expressly prohibited or excluded under the applicable Program Policy; or
- Any other systems, applications, infrastructure, or assets for which the Bounty Hunter has not been authorised to conduct testing.
Any vulnerability identified or reported outside the approved scope may not be eligible for a Bounty or any other recognition.
The decision to review, accept, reject, or award a Bounty for an out-of-scope vulnerability shall remain at the discretion of the relevant Customer and subject to the applicable Program Policy.
c. Interaction and Code of Conduct
Bounty Hunters must comply with the Company’s applicable Code of Conduct and maintain professional and respectful behaviour while interacting with Customers, other Bounty Hunters, Company personnel, or any other participants on the Platform.
d. Public Recognition
A Bounty Hunter may be eligible for public recognition for a reported vulnerability if all of the following conditions are satisfied:
- The Bounty Hunter is the first person to submit a new and valid report for the relevant vulnerability;
- The vulnerability is confirmed as a valid security issue through the Company’s applicable triaging or validation process; and
- The Bounty Hunter has complied with these Terms, the applicable Program Policy, the Vulnerability Disclosure Mechanism, and all other applicable Company policies.
Any form of public recognition shall remain subject to the applicable Program Policy and any confidentiality or disclosure restrictions imposed by the Customer or the Company.
e. Bounty Awards
The Bounty Hunter acknowledges and agrees that the decision to award a Bounty, as well as the amount of any Bounty, is determined by the relevant Customer in accordance with the applicable Program Policy.
The Company does not guarantee that a Bounty will be awarded for any submitted vulnerability report.
A Bounty Hunter must not pressure, threaten, coerce, harass, or otherwise improperly influence a Customer or the Company to increase or alter a Bounty amount. Any Bounty Hunter found engaging in such conduct may have their account suspended or permanently terminated at the Company’s discretion, subject to applicable policies and law.
Bounty Payments to the Bounty Hunter
Not all Bounty Programs offer monetary rewards. It is the responsibility of each Bounty Hunter to carefully review the applicable Program Policy and understand the eligibility requirements, scope, reward structure, and any other conditions before participating in a Bounty Program.
1. Currency and Settlement
Bounty values may be displayed in the currency specified by the relevant Customer or Bounty Program, including, for example, INR, USD, SGD, or another applicable currency (“Public Currency”).
Where currency conversion is required for settlement and payment, the conversion method, applicable exchange rate, settlement currency, and any relevant conditions shall be determined in accordance with the applicable payment process and Program Policy.
The final payment may be subject to applicable taxes, tax deductions, withholding requirements, and other legal or regulatory obligations.
2. Banking and Transfer Charges
Unless otherwise specified in the applicable Program Policy or payment terms, any bank charges, intermediary bank charges, foreign exchange costs, or other transaction-related expenses associated with the payment of a Bounty may be handled in accordance with the Company’s applicable payment procedures. The applicable treatment of such charges will be communicated where relevant.
3. Eligibility and Employment Restrictions
The Bounty Hunter is responsible for ensuring that their participation in a Bounty Program does not violate:
- Any employment agreement;
- Any confidentiality obligation;
- Any contractual restriction;
- Any conflict-of-interest policy; or
- Any applicable law, regulation, or other legal obligation.
The Bounty Hunter is solely responsible for determining whether they are eligible to participate in a Bounty Program and accept any Bounty payment.
4. Participation by Minors
If a Bounty Hunter is a minor or is otherwise not legally eligible to independently enter into these Terms under applicable law, participation may be permitted only where expressly allowed by the Company and subject to any legally required parental or guardian consent, identity verification, KYC requirements, or other applicable procedures.
Where legally required, any Bounty payment to a minor may be made to or through the minor’s parent or legal guardian, subject to applicable law and completion of any required verification procedures.
Public Disclosure of Bounty Awards
A Bounty Hunter must not publicly claim, announce, or represent that they have received or won a Bounty in relation to a particular Bounty Program unless and until the Bounty has been formally assigned or awarded to them.
After a Bounty has been awarded, the Bounty Hunter must continue to comply with all applicable confidentiality, disclosure, and publicity restrictions established by the Customer, the Program Policy, or the Company. This may include restrictions relating to:
- The Customer’s name;
- The affected asset or system;
- Details of the vulnerability;
- The Bounty amount;
- Screenshots, reports, or technical information; and
- Any other confidential or non-public information.
The Bounty Hunter must not disclose such information unless expressly permitted under the applicable Program Policy or by the relevant Customer and/or the Company.