U.S. Cyber Alliance pays security researchers for finding and responsibly reporting real security issues in our systems. We want to hear from you. If you follow these rules, we will treat your work as authorized and will not take legal action against you.
Who can take part
This program is open to people who meet at least one of these:
- You have completed a U.S. Cyber Alliance training program.
- You are an approved user of U.S. Cyber Alliance intelligence tools or systems.
You must also be at least 18 years old, not live in a country under U.S. sanctions, and not be a current employee or contractor of U.S. Cyber Alliance or have been one in the last 6 months. Your eligibility will be confirmed before we pay you.
In scope
- https://uscyberalliance.com and its subdomains.
- U.S. Cyber Alliance intelligence tools and platforms: System list available upon request, contact your account TAM for further details.
Out of scope
- GoDaddy's own platform, website builder, and hosting systems. Report those issues to GoDaddy.
- Third-party services we use but do not own, such as Microsoft, Proofpoint, Cisco, Cloudflare, Amazon Web Services, 1Password, Bolt.new, Microsoft Azure, and Paypal.
- Denial of service, load testing, or spam.
- Social engineering, phishing, or physical attacks against our staff, members, or offices.
- Reports from automated scanners with no proof that the issue can be exploited.
- Missing security headers, clickjacking on pages with no sensitive actions, SPF/DMARC settings, and banner or version disclosure, unless you show real impact.
Rules
- Test only with your own accounts or test accounts we give you.
- Do not view, change, copy, or delete other people's data. If you see personal data by accident, stop, report it, and do not keep it.
- Do not try to keep access after you prove an issue exists.
- Give us time to fix the issue before you share it publicly. We ask for 90 days, or less if we tell you the fix is done.
- One issue per report. If more than one person reports the same issue, the first valid report gets the reward.
Rewards
We pay based on how severe the issue is, using CVSS 3.1 or 4.0 and the real impact on our systems.
Severity | Reward (USD)
Critical | $2500
High | $1250
Medium | $750
Low | $250
- We decide the final severity and reward.
- We pay within 30 days after we confirm the issue, through; Wire, Crypto (XMR), or Paypal.
- You are responsible for any taxes. We may ask for a W-9 or W-8BEN before we pay you.
- We may pay more for issues that are well written up or have a big impact.
How to report
Email security@uscyberalliance.com
Please include:
- What the issue is and where it is (URL or system).
- Steps to reproduce it.
- What an attacker could do with it.
- Screenshots, a video, or proof-of-concept code.
- Your name or handle and how you qualify for the program.
What to expect from us
- We will confirm we got your report within [3] business days.
- We will give you a first severity assessment within [10] business days.
- We will keep you updated until the fix is done.
- We will credit you publicly if you want it.
Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized. We will not take legal action against you, and we will not ask law enforcement to act against you. If a third party takes legal action against you over work done under this policy, we will make it known that your work was authorized. If you are not sure whether something is allowed, ask us at security@uscyberalliance.com before you test it.
Changes
We may change this program at any time. Any change applies only to reports sent after the change is posted.