Bug bounty
Find a hole in our fence. We'll thank you, and pay you.
No system is perfect, ours included. If you find a security weakness in our website or in the services we run, tell us before anyone else. We'll fix it quickly, keep you informed, and reward findings that prove real.
- Rewards for valid findings
- No legal action for good-faith research
- Your report stays confidential
- Reports in Arabic or English
From your report to your reward
You report
Write to security (at) ultaria.com with what you found
We confirm
We aim to reply within three working days
We fix
And tell you when it's done
You're rewarded
By severity, once the finding is validated
Ground rules, for both sides
Responsible disclosure works when both sides keep their word. Here is ours, and what we ask of you.
Tell us first, and soon
Report a suspected weakness as soon as you find it. The sooner we know, the sooner it is closed.
Give us time to fix it
Keep the details private until we confirm the fix. Please don't share them publicly or with anyone else before then.
Use your own accounts
Test only with accounts and data that belong to you. Don't read, change or delete anything that belongs to someone else.
No pretending
Don't pose as our staff, a customer or another researcher, and don't try to trick our team. Social engineering is not part of this programme.
We won't come after you
If you follow these rules and act in good faith, we will not take legal action against you over your research.
We keep it between us
Your report is confidential. We don't share your personal details with anyone without your consent, unless the law requires it.
What earns a reward
A report qualifies when:
- You are the first to report the weakness.
- You include a working proof of concept, or clear steps to reproduce it.
- It affects a system in scope: ultaria.com, its subdomains, or a service we operate ourselves.
- You followed the rules on this page while finding it.
- It has not been made public before we fix it.
- We are legally able to pay you where you live.
Rewards that follow the risk
Rewards are paid as money or as credit on Ultaria services, whichever you prefer. Once our experts validate the finding, we propose an amount that follows how serious it is. If you think it is not fair, an independent third party that we both agree on assesses it.
Severity sets the reward
A weakness that exposes customer data or gives control of a system earns more than one with limited effect.
Credit where it's due
With your permission, we thank you by name on this page once the fix is live.
One reward per weakness
If several people report the same weakness, the first complete report is the one rewarded.
A second opinion on the price
Not happy with the amount? We agree with you on an independent security expert, who reviews the finding and recommends a fair reward. We pay what they recommend.
Out of scope
We don't reward the following, and we may not reply to reports about them.
Attacks on people and premises
Social engineering and phishing, and physical attacks on offices, data centres or equipment.
Anything that disrupts service
Denial-of-service attacks, brute forcing of any kind, and user enumeration by brute force.
Scanner output
Reports generated by automated tools without a demonstrated, working exploit.
Other people's software and systems
Bugs in third-party or open-source software, including WordPress and its plugins, and tampering with what is sent to payment processors. Report those to their owners. We do the same. Open source
Our customers' sites
Websites, servers and applications that customers run on our platform. They belong to the customer, and testing them needs the customer's permission.
Headers and settings alone
Missing security headers or cookie flags, clickjacking, SPF, DKIM, DMARC or SSL settings, version numbers, directory listings and server IP addresses, where they don't lead directly to a weakness.
Low-impact web issues
Self-XSS, CSRF with no real effect, open redirects, text injection on error pages, homograph attacks, cache issues and browser bugs.
Account housekeeping
Password rules, session lifetimes, CAPTCHA strength, missing rate limits, reuse of one-time codes, and anything that needs access to the victim's device.
Write a report we can act on
- 1
Say what you found
The address or system affected, and the kind of weakness.
- 2
Show how
Steps we can follow, or a proof of concept. Screenshots or a short video help.
- 3
Say what it could do
What an attacker could reach or change.
- 4
Tell us how to reach you
And the name you'd like us to credit, if any.
Send your report here
It goes straight to our security team. Need to share screenshots or a video? Send the report first and we will reply with a safe way to share them.
What researchers ask
How much do you pay?
It depends on severity, so we don't publish a table. You hear the amount after our experts validate the finding. If you disagree, an independent third party we both agree on reviews it and sets a fair amount.
Who is the independent third party?
A security professional or firm that neither of us works for, chosen together for each case. They see the report and our assessment, and recommend the reward.
How quickly will you reply?
We aim to confirm that we received your report within three working days, and to keep you updated until the fix is live.
Can I publish my findings?
Yes, after we confirm the fix. We're glad to agree the timing and the wording with you.
I'm a customer. Can I report something too?
Yes. The same rules and rewards apply, and reporting a weakness never counts against your account.
What if I'm not sure it's a real weakness?
Send it anyway, with what you observed. We would rather read ten reports that turn out to be nothing than miss the one that matters.
Bug bounty
Found something? Tell us before anyone else.
Write to security (at) ultaria.com, in Arabic or English. We read every report.