Bug Bounty Program

Purpose

The Securitize Bug Bounty Program aims to identify and remediate vulnerabilities in Securitize’s systems, ensuring the highest levels of security and trust for our users and stakeholders. We encourage security researchers, developers, and ethical hackers to help us secure our platform by responsibly disclosing vulnerabilities.

Overview

The program offers financial rewards and recognition for responsible disclosures. The higher the severity of the identified vulnerability, the greater the reward.

Program Scope

A tokenized fund on a public blockchain. Managed by the world's largest asset manager.¹

In-Scope Assets

Primary Systems:

• https://id.securitize.io/
• https://cp.securitize.io/

Primary Systems:

• https://cp.sandbox.securitize.io/
• https://id.sandbox.securitize.io/

Access Credentials:

To facilitate accurate testing, Securitize will provide specific testing credentials to authorized participants. These credentials are restricted to the testing environment only and must not be used outside the scope of this program. Please contact bugbounty[at]securitize.io to request credentials, providing details on your testing intent.

Examples of Accepted Vulnerabilities:

• Cross-Site Scripting (XSS)

• SQL Injection

• Cross-Site Request Forgery (CSRF)

• Authentication and Authorization flaws

• Remote Code Execution (RCE)

• Any other exploitable vulnerability

Out-of-Scope Assets

• Any third-party services and applications that are not directly under Securitize’s control.

• Social engineering attacks, denial of service (DoS) attacks, and any other activity that may impact service availability.

• Physical testing of office premises.

Examples of Excluded Vulnerabilities:

• Bugs resulting from social engineering or phishing

• Distributed Denial of Service (DDoS) attacks

• Issues caused by outdated software in third-party systems

Additional Notes

• Black-box testing is permitted for production platforms (https://id.securitize.io/ and https://cp.securitize.io/).

• We will accept controlled and non-disruptive DDoS tests targeted at uncovering special vulnerabilities, zero-days, or malformed network APIs.

Rewards

Rewards are provided based on the severity and impact of reported vulnerabilities:

• Critical: High-impact issues such as remote code execution or severe authentication flaws.

• High: Issues affecting sensitive data, including SQL injection or access control vulnerabilities.

• Medium: Moderate issues, such as XSS.

• Low: Minor issues or best practice improvements.

Note: Securitize reserves the right to determine the reward amount based on the severity and quality of the report.

Eligibility Requirements:

• Participants must be at least 18 years old.

• Participants must follow responsible disclosure practices, refraining from public disclosure until the issue has been resolved.

Ineligibility:

Any participant found in violation of the above guidelines will be ineligible for rewards and may be permanently disqualified from the program.

Guidelines for Participation:

• Avoid any actions that could cause harm to Securitize or its users, such as unauthorized data extraction or service disruptions.

• Use test accounts and avoid accessing or modifying data belonging to other users. Accessing or modifying real customer data is prohibited. Report any unauthorized access immediately.

• Do not perform any testing that may affect system stability or performance.

• Maintain confidentiality regarding any vulnerability details until they are publicly disclosed by Securitize.

Submission Process

Step 1

Prepare a clear and concise report including:

• A detailed description of the vulnerability.

• Steps to reproduce the issue.

• Any supporting evidence, such as screenshots, PoC code, or logs.

Step 2

Submit the report to bugbount[at]securitize.io or through the designated form on our website.

Step 3

Once submitted, a member of the Securitize security team will review the report, and you will be notified of the status within two weeks.

Processing of Reports

• Reports are evaluated based on severity, reproducibility, and quality. Compliance and IT Security will review all reports for regulatory compliance. Vulnerabilities in trading systems, investor data, or financial transactions will undergo additional review.

• Participants are encouraged to avoid duplicate submissions; only the first reporter of a unique issue will be eligible for a reward.

• Securitize reserves the right to modify or cancel the program at any time

Legal and Confidentiality Requirements

• Participants are required to comply with all applicable laws during testing.

• Unauthorized access or disclosure of data without prior written consent may result in disqualification.

• Personal data collection should be limited to information directly relevant to the vulnerability.

• All disclosed information regarding security vulnerabilities is to remain confidential until Securitize issues a public advisory.

Contact Information

For any additional questions, contact our security team at bugbounty[at]securitize.io.