Abstract Sign-off and Bounty Range
This is a novel space, to ensure we’re on the same page we recommend that Researchers initially submit a high-level abstract of their findings and list the affected model(s). Within 3 business days we will respond with a decision on whether or not the flaw is within scope and what the likely range of bounty will be. The Researcher can then decide to progress by submitting full details of the discovery.
Validate Submitted Information
We attempt to validate the information submitted by Researchers within 2 weeks. During this period, our team will thoroughly assess the vulnerability to confirm its validity and impact. If the complexity of the submission requires further time for validation, we’ll let the Researcher know early in this process.
In the event that our team is experiencing a heavy load, researchers will be informed of load status via the 0DIN portal. This transparency helps set expectations regarding the timeline for validation and further communication.
Duplicate Discoveries
The security bug must be original and previously unreported. Duplicate submissions of Medium or higher severity received within 7 days from the date and time of first submission will split the bounty between the Researchers. If duplicate submissions are of unequal quality, the split will be at the level of the lesser report, and the greater report will receive a prorated additional bounty on top of the split. 0DIN will determine the eligibility of the submissions using its internal database clock.
For submissions of Low severity, the first submission receives 100% of the bounty, the second submission receives 50% bounty, the third submission 20% bounty, and the remainder simply share credit, provided that the security vulnerability has not been already disclosed to the vendor or publicly disclosed through any channels prior to submission.
Please see our
Program Scope for more information about the bounty scopes.
Additional Features and Bug Bounty Opportunities
Researchers with a proven track record of submitting quality vulnerabilities may be provided access to additional features and opportunities at 0DIN’s discretion. Access to these tools and opportunities may be subject to additional terms and requirements which will be provided to Researchers prior to accessing such feature or opportunity.
Researcher Payment
We commit to submitting payment to Researchers within 30 days of reaching a contractual agreement. This ensures that Researchers are compensated promptly for their contributions. Bounties can be donated to certain charities (see above), and should be indicated by the Researcher during the submission process.
As a matter of both policy and law, we must know who we are paying. Researchers must submit a valid government issued photo identification (ex: passport, drivers license) to be eligible for payment. Researchers are responsible for their own tax obligations in light of the reward. US based Researchers must provide a completed IRS W-9 form. Non-US based Researchers must provide a completed IRS W-8 form.
Vendor Notification
We will attempt to contact the affected vendor via publicly listed contact information after reaching a contractual agreement with the Researcher to provide an overview of the vulnerability. We will check the vendor’s website for registered contacts via “.well-known/security.txt” (
RFC 9116). If a formal security contact is unavailable, we will attempt to reach the vendor using the following email addresses: psirt@, security@, secure@, support@, and info@. If we successfully connect with the vendor, the vendor may opt-in to receive the full vulnerability report details for the applicable vulnerability disclosed in our vendor notification.
Public Disclosure Timeline
For model vulnerabilities, we will publish details of the vulnerability once we determine, in our sole discretion, that the vulnerability has been mitigated so that it no longer materially impacts mainstream models.
For application vulnerabilities, if we are unable to connect with the vendor after three attempts over a two-week period, we will proceed with public disclosure of the vulnerability within 30 days. This ensures that the information is made available to the public in a timely manner to mitigate potential risks. If we successfully connect with the vendor, we will provide them with up to 4 months (120 days) to address the issue before public disclosure. This time frame allows the vendor sufficient time to develop and deploy a fix while ensuring that the vulnerability is eventually disclosed.
Public Disclosure
Once the public disclosure requirements have been met, we will post and advertise the vulnerability publicly. The 0DIN team will handle this process, and we will provide (optional) credit to the discovering Researcher, acknowledging their contribution to improving security.
By adhering to this policy, we aim to balance the need for public awareness of vulnerabilities with the necessity of giving vendors adequate time to address security issues. Our goal is to foster a collaborative environment that enhances overall cybersecurity.