We reward security researchers who report vulnerabilities that materially
improve the safety of TotalCtrl and the data our customers keep in it.
There is one submission channel and one set of rules: report through the
Vulnerability Disclosure Policy, and if your finding qualifies, we will
raise the question of a reward ourselves. You never have to ask.
How rewards work
Rewards are discretionary. We do not publish a fixed price
list, and we would rather say so plainly than advertise a table we might
have to argue about later. What we decide is based on:
Impact. What an attacker could actually reach — with a
strong bias toward anything crossing a workspace boundary, since
TotalCtrl is multi-tenant and one customer reading another customer's
data is the most serious class of bug we can have.
Ease of exploitation. Whether it needs an
authenticated account, a privileged role, a victim's cooperation, or
nothing at all.
Report quality. A clear reproduction that saves us a
day of investigation is worth more than a one-line claim, and we will say
so in the amount.
Novelty. A whole class of issue we had not considered
is worth more than another instance of one we had.
Highest rewards go to authentication bypass, cross-tenant data access,
remote code execution, and anything exposing credentials or customer data at
scale. We assess every qualifying report on these terms regardless of who
sent it.
Recognition
Whether or not a report earns a payment, we will credit you by name in our
security acknowledgments if you would like — and keep you out of them if
you would rather. We ask before publishing anything, every time.
Eligibility
First report wins. Where several people report the same
issue, the reward goes to the first clear report we receive. We will tell
you if yours is a duplicate, and what it duplicates.
One reward per issue, not per affected endpoint. Several
symptoms of a single root cause are one finding; tell us all of them
anyway, because they help us fix it properly.
The issue must be new to us. Something already in our
backlog, already reported, or already public is not eligible — we will say
which, and when we first knew about it.
You must have followed the disclosure policy. Accessing
other people's data beyond what proves the bug, degrading the service, or
withholding details pending payment disqualifies a report.
Not open to current or former TotalCtrl employees and
contractors, their immediate families, or anyone who worked on the
affected code.
We cannot pay individuals in jurisdictions where doing so would breach
applicable sanctions or export controls. Rewards may require tax
documentation, and any taxes owed are yours.
What does not qualify
Everything listed as out of scope in the
Vulnerability Disclosure
Policy is also outside this program. In addition, these do not earn a
reward on their own:
Missing security headers, cookie attributes, or TLS configuration
preferences with no demonstrated exploit.
Rate-limiting and brute-force concerns without a working demonstration
of impact.
Absence of a specific security feature, as distinct from a flaw in one
we have.
Content spoofing or text injection with no scripting or credential
consequence.
Vulnerabilities requiring a rooted or jailbroken device, a
man-in-the-middle position the user has consented to, or physical access
to an unlocked device.
Issues in end-of-life browsers, or ones that depend on a browser
configuration the user must deliberately weaken.
Reports generated wholesale by a scanner or a language model, submitted
without verification. We read every report by hand, and an unverified one
costs us the time it saved you.
Timelines
The response commitments in the
Vulnerability Disclosure
Policy apply: acknowledgment within 3 business days, an assessment
within 10, and updates at least every 14 days until it is closed. A reward
decision is made when we confirm the finding and its severity, which is
usually at the assessment stage rather than after the fix ships — you should
not have to wait for our release schedule to learn where you stand.
We may change or end this program at any time, and we will not apply a
change retroactively to a report already submitted. Questions go to
security@totalctrl.app.