Built to be unbreakable.

Bug Bounty programme

Internetivo has been building and running online services since 2010, and we take the security of our platform and our customers seriously. We run a private, invitation-controlled Bug Bounty programme for security researchers. Because internetivo.com is a live platform serving real people, participation is by approval only: you register, apply, and are approved by us, and we grant you a scope to test before you begin. The programme page gives the overview; this section is the full policy.

How to take part

1. Register an account on internetivo.com.
2. Apply to the programme through the Bug Bounty channel, by opening a ticket in the Bug Bounty department. Tell us your handle and the kind of testing you do.
3. We review your application. If we approve you, we confirm your scope and the rules for your testing in writing.
4. Only after approval may you begin testing, and only within the scope we granted.

Testing anything without our prior approval, or outside your granted scope, is not authorised and is not covered by this programme.

Where you test

Approved researchers test against a staging copy of the platform that we name in your approval, never against internetivo.com itself. internetivo.com serves real people, real data and real money, so it is out of scope for everyone. Production testing may be offered later, by name, to researchers with a completed event and a clean track record. On staging, test only within the scope we grant you in writing and under the rules of engagement below: use only accounts you create yourself, prove an issue with a single record of your own and stop there, and never run automated scanners or anything that degrades availability.

If demonstrating an issue would require touching another person’s account, data, or money, stop there: report it with what you already have and do not prove it against anyone else’s data. One record of your own is always enough. Report it, do not prove it.

What to look for

We classify findings by real-world impact, using the rubric below. Your report proposes a severity; we confirm it. The examples are indicative, not exhaustive.

Points are awarded when a report is accepted, never at submission, and severity is our call against this published rubric. Specific reward amounts are confirmed when you are accepted into the programme and announced for each programme or event; see “How rewards work” below.

Out of scope and non-qualifying

The following are out of scope, and some are things you must never do:

• Any system, domain, or environment other than the staging copy and the scope we grant you in writing, including internetivo.com itself.
• Anything that touches money, payouts, invoices, or financial records.
• Any other user’s or customer’s personal data, account, or content. This is a multi-tenant platform, and other people’s data is never a valid target.
• Denial of service, load or stress testing, or anything that degrades availability.
• Social engineering, phishing, or physical attempts against our staff, customers, or infrastructure.
• Automated scanners, brute forcing, or high-traffic tooling.
• Accessing, changing, or deleting data that is not yours. If you come across someone else’s data, stop immediately, do not save or share it, and tell us.
• Third-party services we rely on (for example our payment processor, DNS, or CDN): report those directly to the vendor.
• Non-qualifying reports: raw scanner output, theoretical issues with no demonstrated impact, best-practice suggestions, and missing hardening headers with no exploit path. We may log these as Informative.

What to do when you find something

Submit one report per issue through the official Bug Bounty channel, by opening a ticket in the Bug Bounty department. A good report includes:

• Asset: the environment and the exact URL, endpoint, or feature affected.
• Class and severity: the vulnerability class and the severity you claim against the rubric above.
• Reproduction: clear, step-by-step instructions we can follow.
• Proof: the minimum needed to demonstrate the issue. One record is enough; never exfiltrate data.
• Impact: what an attacker could actually do with it.

What happens next: your report moves through received → triaged → accepted, duplicate, out of scope, or informative → fixed → paid. We aim to give a first response within five business days and a realistic remediation timeline after we triage. Duplicates are recorded against the original report with a timestamp, which protects both sides.

How rewards work

• Points at acceptance. You earn points when a report is accepted and its severity confirmed, never for volume of submissions.
• Reputation and leaderboard. Points build a public track record shown as handle and points only, never your legal name, country, or anything from your identity.
• Tiers unlock trust. A track record earns faster triage, private scope, and, over time, a wider scope. Trust is extended gradually.
• Paid by bank transfer. Accepted rewards are paid by bank transfer, outside the platform, after the identity and sanctions check below.
• Identity at payout, not at the door. You report and accrue points pseudonymously (a handle and an email). Identity verification, sanctions screening, and a payout destination that matches the verified name are required only for your first payout.

The programme is growing in stages. Today it runs on reputation and event prizes; specific monetary reward amounts and any time-boxed events are announced to approved participants. We are honest about this rather than promising a payout the programme is not yet ready to make.

First event: Internetivo bug bounty weekend, 31 October to 2 November 2026 (staging only, about EUR 1,000 prize pool).

Who we can pay

Eligibility to be paid is subject to identity verification and sanctions screening at your first payout. We can pay researchers in most countries in EUR, but we cannot pay anyone located in, or a national or resident of, a country or region under sanctions or embargo, or anyone appearing on an applicable sanctions list, or where our payment partners cannot lawfully operate. Reputation and leaderboard standing are open to every valid reporter regardless of payability.

Safe harbour

For approved participants acting in good faith and within the scope we granted, we will treat your research as authorised, we will not pursue or support legal action against you for accidental, good-faith violations, and we will work with you to resolve issues quickly. This protection does not extend to testing carried out before approval, outside your granted scope, or in breach of the rules below, and it does not cover harm to other people’s data, money, or access to the service.

Rules of engagement

• Do not test before you are approved, and stay inside the scope we grant you.
• Use only accounts you created yourself. No accounts but your own.
• Do not exfiltrate data. One record is enough to prove an issue; stop there.
• Test manually and carefully. No automated scanners, no denial of service.
• No social engineering or phishing of our staff or customers.
• Do not disclose an issue publicly before we have fixed it and agreed the timing with you.

Coordinated disclosure

Please give us up to 90 days from your report before any public disclosure, or until a fix has shipped if that is sooner, and coordinate the timing with us. We will credit you for a valid report if you would like to be named.

Found something without being in the programme?

If you come across a security issue without being an approved participant, please do not investigate further and do not access anyone else’s data. Register an account and report it through the Bug Bounty channel, and do not disclose it publicly. We will take it from there.