Reward tiers
Bounties are awarded by the severity of the verified vulnerability: Intempt credits plus swag. Every report is evaluated case by case. Intempt determines the final severity classification and reward, and exceptional findings may receive more at our discretion.
Low Severity
2,000 Intempt credits
Intempt sticker pack
Minor issues with limited impact: non-sensitive information disclosure, low-risk misconfigurations, or UI-level bugs with minimal security implications.
Medium Severity
5,000 Intempt credits
Intempt t-shirt and sticker pack
Issues that could lead to limited data exposure, privilege escalation in restricted contexts, or meaningful bypasses of non-critical security controls.
Critical Severity
10,000 Intempt credits
Intempt t-shirt and sticker pack
Severe vulnerabilities such as remote code execution, authentication bypass, SQL injection, access to sensitive customer data, or full account takeover.
Scope
In scope
- intempt.com: marketing site and web application
- app.intempt.com: the Intempt console and product UI
- api.intempt.com: public-facing API and SDK ingestion endpoints
- Authentication and authorization (organization and project roles, SSO, MFA)
- Billing and subscription flows, including credit balances
- Customer data ingestion, handling and storage
- Per-tenant isolation and per-customer AI model environments
- The Intempt desktop and mobile apps as they talk to our APIs
Out of scope
- Third-party services and integrations not operated by Intempt
- Social engineering, phishing, or physical attacks against Intempt employees
- Denial-of-service (DoS/DDoS) attacks
- Spam or rate-limiting issues without a security impact
- Vulnerabilities in outdated browsers or platforms we do not support
- Reports from automated scanners without a demonstrated proof of concept
- Clickjacking on pages with no sensitive actions
- Missing security headers that do not lead to a demonstrable exploit
- Issues that require a user to install or run a third-party recipe, where the impact is limited to that user's own project and privileges (see below)
Marketplace recipes and third-party content
Recipes and Blu agent configurations published to the Marketplace are written by third parties in the Intempt Collective, not by Intempt. Installing a recipe lets it act inside your own project on your behalf, and that decision, as with any third-party extension, rests with the user who installs it. We review submissions and apply confinement controls to limit what a malicious recipe can reach, but no review can anticipate every attack, and we make no representation that any given recipe is safe.
Reports whose exploit path requires a user to install or run a recipe, and whose impact is limited to the data and privileges that user already holds, are not eligible for a reward. This includes a recipe reading, modifying, or exfiltrating the installing user's own project data. A recipe you install acts with your access, and demonstrating that it can send your own data somewhere is a property of that decision rather than a vulnerability in Intempt.
This exclusion is about user choice, not about our confinement boundaries. Where a recipe reaches beyond the installing user's own access, we want to hear about it. The following remain fully in scope and eligible:
- A recipe or Blu agent escaping its project boundary or reaching another organization's or tenant's data, sessions, or credentials
- A recipe obtaining Intempt platform secrets or infrastructure credentials such as service tokens, model-provider keys, or internal endpoints no recipe should reach
- Bypassing Marketplace publishing, review, or listing-integrity controls, for example publishing under another party's identity, or altering a listing after review
- Any flaw that allows a recipe to be installed, updated, or executed without the user's action or consent
What to report
We are interested in vulnerabilities with a real security impact. Examples include, but are not limited to:
How to report
Send your report to security@intempt.com with “Bug Bounty” in the subject line. Reports sent to any other Intempt address will result in removal from the program.
Please include the following:
- Description
- A clear summary of the vulnerability and its potential impact.
- Steps to reproduce
- Detailed, step-by-step instructions that let us reliably reproduce the issue.
- Proof of concept
- Screenshots, screen recordings, HTTP request/response logs, or working exploit code.
- Affected asset
- The URL, endpoint, or component where the vulnerability exists.
- Suggested severity
- Your assessment of the impact (Low, Medium, or Critical).
- Your contact info
- How we can reach you for follow-up questions.
- HackerOne profile (optional)
- Your HackerOne username or profile URL. Reports with a profile may be reviewed sooner.
Our process
Initial Review
We respond to reports that describe vulnerabilities eligible for a reward.
Verification
Our security team reviews and attempts to reproduce the issue. We may reach out for more detail. Please allow us reasonable time to investigate.
Severity Assessment
We classify severity based on exploitability, impact, and affected scope. We welcome your input, but the final determination rests with Intempt.
Remediation and Reward
Once the issue is confirmed and patched, we apply the credits to your Intempt account and ship your swag.
Reward terms
Rewards are issued as Intempt credits applied to the eligible reporter's account, plus Intempt swag. Credits are not cash payments and cannot be exchanged for cash or transferred to another account.
Severity and rewards are determined solely by Intempt. These determinations are final and not subject to negotiation. If you do not hear back from us regarding a report, the submission was not deemed a qualifying vulnerability and no reward will be issued.
Rules of engagement
- Do not access, modify, or delete data belonging to other users. Use your own test accounts only.
- Do not perform actions that could degrade service availability (DoS, brute force, excessive scanning).
- Do not publicly disclose a vulnerability before we have had a reasonable opportunity to address it.
- Act in good faith. Avoid privacy violations, data destruction, or service interruption.
- One report per vulnerability. Group multiple instances of the same class of bug into a single report.
- You must be the first to report the vulnerability to be eligible for a reward.
- Send reports only to security@intempt.com. Sending a bug report to any other Intempt address will result in removal from the program.
- Intempt employees, contractors, and their immediate family members are not eligible.
Safe harbor
We consider security research conducted in accordance with this policy to be authorized. We will not pursue legal action against researchers who discover and report vulnerabilities responsibly and in compliance with the rules above. If a third party initiates legal action against you for activities conducted in accordance with this policy, we will make it known that your actions were authorized by Intempt.
Frequently askedquestions.
Common questions about rewards, severity, and disclosure.