A Bug Bounty Platform is a Platform through which Companies and Institutions of any kind can receive reports relating to the vulnerabilities afflicting their IT systems. These reports are provided by our Security Researcher Community.

To participate, you must register on our platform, accept the Terms of our Platform, the Community Code and the Policy of the Bug Bounty Program. At that point you can report the vulnerabilities in the appropriate section of the Program. Remember that to participate in a Private Bug Bounty Program, just request the program by uploading the information that will be requested from the company.

A qualifying bug is a vulnerability that has not yet been discovered and that could have an impact on the security of companies’ information infrastructures. The reports must include the (reproducible) steps that allowed the hacker to identify the vulnerability, in addition, the Proof of Concept and the suggestions for mitigating the problem must also be included in the report.

After reporting a vulnerability, the prepared security team will examine the report and take care of the validation process, which basically consists of reproducing the steps that led to the identification of the vulnerability. If the validation process ends successfully, it is possible to receive a reward.

To be eligible for a reward, you must be the first to report the vulnerability, the bug must be validated by the security team set up for the validation process, and you must have meticulously respected all the rules set out in the Bug Bounty Program in issue.

We are committed to responding to all bug reports as soon as possible within a week, but consider that response time may vary depending on the complexity of the reported vulnerability. In addition, we guarantee the sending of the reward within 72 hours following the validation of the Report.

The amount of the reward varies according to the severity of the reported vulnerability and its potential impact on the company. The severity of the vulnerability is based on the CVSS 3.1 standard and therefore vulnerabilities can be identified with: Low Gravity, Medium Gravity, High Gravity and Criticism. For each of these four vulnerability categories, different rewards are awarded for each Bug Bounty Program, these rewards are visible in the third section of each Program

It is possible to do so provided that the Program’s Vulnerability Policy, Platform Terms and Community Code are respected, and the details of the company on which that vulnerability has been identified must always be deleted.

Unless otherwise requested by the Bug Bounty Program, we prefer that reports be sent in Italian.

Participating in a Bug Bounty Program requires a solid understanding of cyber security principles and Hacking techniques. That said, CyberDart’s Bug Bounty Platform boasts the absence of barriers to entry for the Hacker Community, so anyone can participate as long as the Program’s Vulnerability Policy, Platform Terms and the Community Code are respected.