Run your disclosure program
Publish your scope, take reports from researchers through your trust center, and work each one through to a fix.
1 min readUpdated
Set up the program
Step 1: Open the program
Choose Reports in the dock, then Program.
Step 2: Write your scope
List what’s In scope, one asset per line (up to 30), and what’s Out of scope. Add a Security email, your PGP key if you have one, and your Full policy.
Step 3: Save it
Select Save program. The form goes live at
app.bynh.io/trust/{your-address}/security.
The form states your safe harbor: people who act in good faith and follow your policy won’t face legal action from you.
How researchers report
Researchers give a title, the affected asset, how bad they think it is, the steps to reproduce it and their email. They can attach up to 5 files (PNG, PDF or TXT, 10 MB each). Each gets a private link to follow the report and reply.
Triage and reply
New reports arrive in Reports and your Inbox. Set the severity and status, assign someone, and use Reply to reporter (emailed to them) or Internal note (only your team; mention a teammate to email them).
| Severity | Aim to reply within | Reward range |
|---|---|---|
| Critical | 12 hours | $3,000–7,500 |
| High | 24 hours | $1,000–2,500 |
| Medium | 48 hours | $300–1,000 |
| Low | 120 hours | $100–300 |
| Info | 120 hours | None |
Statuses run from New and Confirmed through Fixing and Fixed to Resolved, with Duplicate and Not valid for reports that don’t stand.
Resolve and reward
Choose Mark as fixed to open Resolve and reward: summarise the fix, confirm the final severity, record any reward and how it’s paid, thank the reporter in your hall of fame and choose when to publish a write-up. bynh records the reward; it doesn’t send money.
Was this helpful?