Bullish.com

No technology is perfect and we believe that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting!

Ratings/Rewards:

For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher which may be appealed if additional evidence of an increased impact can be provided.

We will also leverage CVSS ratings if there is any ambiguity in where the submission falls in the VRT to help maintain the severity and impact of the finding. CVSS generally tracks with the VRT as such:

Severity Level	Critical	High	Medium	Low	Informational
VRT	P1	P2	P3	P4	P5
CVSS v3	10.0-9.0	8.9-7.0	6.9-4.0	<= 3.9 Low Impact	<= 3.9 Informational

Note that we will not pay for submissions that count as Informational/P5.

We reserve the right to make any final determination of rating levels for any reported vulnerability.