BUG BOUNTY
Help us build a
better platform.
Found a bug on cyndra.ai? Report it. We review every submission and reward valid findings.
Three reward tiers based on severity. Payouts within 7 days of verification.
REWARDS
Three tiers.
Paid your way.
Rewards scale with impact. We assess severity based on the user harm and data exposure a bug enables. The team makes the final call.
$5 credit
Visual bugs that don't affect functionality.
- UI glitches
- Typos
- Broken layouts
$50 credit
Features that don't work as intended.
- Broken features
- Errors and crashes
- Incorrect behavior
$250 credit
Issues that put users or data at risk.
- Security vulnerabilities
- Data exposure
- Authentication bypass
Rewards paid as account credit or gift cards.
HOW IT WORKS
How to submit.
- 01Find a bug on cyndra.ai or the Cyndra platform.
- 02Fill out the submission form with steps to reproduce.
- 03Our team reviews within 7 days.
- 04Valid bugs are verified and rewarded.
GUIDELINES
The fine print.
- 01One submission per bug.
- 02No destructive testing or data modification.
- 03First valid report wins. No duplicates.
- 04We will not pursue legal action against researchers who follow these guidelines.
- 05Rewards are at our discretion based on severity and impact.
- 06In scope: cyndra.ai web application and the Cyndra platform.
- 07Out of scope: third-party services, social engineering, denial of service, and physical attacks.
TERMS
The legal bits.
By participating in Cyndra's Bug Bounty Program, you agree to the following:
- You must be 18 years or older to participate.
- You must not reside in a jurisdiction subject to US sanctions (OFAC).
- Rewards are issued at Cyndra's sole discretion based on severity, impact, and validity.
- Duplicate reports are not eligible. First valid submission wins.
- Maximum total program payouts are capped at $2,500 per calendar month. Cyndra reserves the right to modify or discontinue this program at any time without notice.
- You must not publicly disclose any vulnerability before Cyndra has had 90 days to remediate it.
- Token rewards are provided as-is with no guarantee of current or future value.
- Personal data submitted is used solely for program administration. See our Privacy Policy.
- Testing must be limited to cyndra.ai and the Cyndra platform. Out of scope: third-party integrations, social engineering, physical security, and denial-of-service attacks.
- Cyndra will not pursue legal action against researchers who act in good faith and comply with these terms.
Found a bug? Send it our way.
The form opens in a new tab. You'll get a confirmation on submit. We review every report and reply within 7 days.
Prefer crypto? Rewards are also available in $CyndraAI tokens. Just mention it in your submission.