|
Pricing | Sign inGet started

Bug Bounty Program Terms

Effective 22 October 2026

1. About these terms

"We", "us" and "Betterteam" mean Betterteam Inc., a Delaware corporation, 2093 Philadelphia Pike #2555, Claymont DE 19703-2424, United States. "You" means the person taking part.

These terms govern participation in the Bug Bounty Program described on the Bug Bounty Program page (the "Program page"). The Scope, Rules of testing, Rewards, What we do not pay for and How to report sections of the Program page at https://www.betterteam.com/bug-bounty are part of these terms, in the version section 13 says applies.

The safe harbor (section 3), the scope (section 4) and the rules of testing (section 5) describe what we authorize and apply to everyone who tests. The rest of these terms (rewards, versions, disclosure timing, data handling, your report's license, and the dispute terms in section 14) is a contract you accept by writing, in your report or in an email before you start testing, that you accept the Bug Bounty Program Terms dated at the top of this page. A report without that line is welcome and covered by the safe harbor, but is not eligible for a reward until you accept; the version rule in section 13 still decides which reward table applies. The safe harbor in section 3 never depends on acceptance.

Our Terms and Policies apply only where they are consistent with these terms and the Program page. Where they conflict with either about the program or security research, these terms win, followed by the Program page (see section 14).

2. Who can take part

You must be 13 or older to take part, and anyone 13 or older may send us a security report. The safe harbor in section 3 still does not depend on your age, or on the requirements below; they apply to rewards. To receive a reward:

  • If you are 13 to 17, a parent or legal guardian accepts these terms for you by email and receives any reward; we cannot pay a minor directly.
  • You must not be a current employee or contractor of Betterteam, or one within the past 12 months, or a member of their household.
  • We must be allowed to pay you: we cannot pay a person, or a person in a place, that US law prohibits us from paying, including under US sanctions such as the OFAC lists.
  • You must not have broken these terms in a material or deliberate way. Such a breach can reduce or cancel the reward and ends your eligibility; a minor slip does neither.

A report may come from more than one person. Name everyone who worked on it and one person to receive the reward; each of you must meet the requirements above, and naming someone else to receive the reward does not get round them. We pay once per issue, to that person, and you share it among yourselves.

3. Authorization and safe harbor

We authorize good-faith security research on the in-scope systems (section 4) that follows the rules of testing (section 5). For that research:

  • We consider it authorized under the Computer Fraud and Abuse Act and similar state laws, and we will not initiate or support legal action against you under them;
  • We will not bring a claim against you under section 1201 of the Digital Millennium Copyright Act for bypassing technological controls as part of the research;
  • We waive the restrictions in our Terms and Policies that would interfere with the research, on a limited basis for work done under the program;
  • We will not bring any other legal claim we control against you for that research; and
  • We consider it conducted in good faith and helpful to the overall security of the Internet.

An accidental, good-faith departure from the rules does not by itself remove this protection, as long as you stop when you notice it and tell us promptly. Reward eligibility, payment and tax paperwork, and the X-Bug-Bounty header are not conditions of this safe harbor.

If a third party takes legal action against you for research this section covers, we will take steps to make it known that your actions were authorized research under the program.

If at any time you are unsure whether your research is consistent with the Program page and these terms, email security@betterteam.com before going any further; the Program page's Scope section says what asking does and does not authorize.

This safe harbor covers only legal claims Betterteam controls. We cannot authorize activity on behalf of customers, vendors or other third parties, or bind government authorities.

This clause is adapted from the disclose.io Core Terms, released under CC0; that is not a claim of certification or endorsement.

4. Scope

Testing is authorized only against what the Scope section of the Program page lists as in scope, in the version section 13 says applies. Everything else, including anything that page lists as out of scope, is not authorized, apart from the subdomain-takeover exception that section states; and we cannot authorize testing of systems we do not control.

If you come across a security issue in another Betterteam system, you may report it, but reporting does not authorize more testing or promise a reward.

5. Rules of testing

The Rules of testing section of the Program page applies as part of these terms. In addition:

  • You are expected to comply with applicable laws; that is an expectation, not a condition of the safe harbor in section 3.
  • If you encounter other people's data, stop that test, tell us at once with minimal, redacted evidence, and handle the data as section 10 requires.
  • A material or deliberate breach of the rules can reduce or cancel a reward and ends your eligibility (sections 2 and 7); a minor slip does neither.

6. Reporting

Send reports as the How to report section of the Program page describes. Neither side publishes the details until section 9 allows it. We may share your report with staff, contractors and vendors who help fix it, and with authorities where the law requires. We may ask for more detail; a report we cannot reproduce does not earn a reward.

7. Severity and rewards

Vulnerabilities in third-party software or libraries are rewarded only if you show a Betterteam-specific exploit.

The reward table, the examples, the minimum for issues confined to www.betterteam.com and the list of what we do not pay for are in the Rewards and What we do not pay for sections of the Program page, which are part of these terms (section 1); which reward table applies is set by section 13.

CVSS v3.1 is our starting point; we set the final severity by the real impact on customers, applicants and Betterteam. The band, the amount within it and any bonus for an exceptional report are our call. If we rate a report lower than you did, we tell you why. A confirmed report is paid at least the minimum of the band we assign, provided your testing followed the rules. A material or deliberate breach of these terms can reduce or cancel the reward and ends your eligibility (section 2); a minor slip does neither. Reward decisions do not change the safe harbor in section 3.

There is no reward for out-of-scope, ineligible, duplicate or already-known issues. Priority goes to the first report with a working proof; a placeholder does not reserve priority. A duplicate is a report of a root cause we already track, whether or not the Program page lists it, and we tell you the date we first learned of it. One root cause is paid once, even if split into several reports; separately exploitable issues are rated separately. Vulnerabilities in third-party libraries or frameworks are rewarded only if you show a Betterteam-specific exploit.

If you disagree with the severity, duplicate status, eligibility or amount, you may reply once with more evidence, as a reconsideration request sent within 30 days of our decision (ordinary questions do not count); our decision after your one reply is final. A final decision does not waive your legal rights.

8. Payment

Rewards are paid in US dollars by PayPal or bank transfer, within 30 days of the later of our confirming the report (valid, in scope and eligible) and our receiving your payment and tax details; if a legal check delays a payment, we tell you why and when. We do not wait for the fix. We cover the fees charged to us for sending the payment; fees your own bank or payment provider charges you are yours.

Before paying, we may ask for your legal name, address and country, and for the tax form the law requires (such as IRS Form W-9 for US persons or Form W-8BEN for many others). Send payment and tax details only through the channel we name at the time, never in a report; we use them only for payment and tax, and our Privacy Policy covers them. You are responsible for your own taxes; we withhold tax where the law requires.

9. Coordinated disclosure

The 90-day disclosure clock applies to every report, including duplicates, disputed and unconfirmed ones, whether or not we confirm the issue. You may publish details once it is fixed or 90 days have passed, whichever comes first. Day 90 runs from our acknowledgement that we received your report, or from 3 business days after you sent it if we have not acknowledged it. We may extend this once, by up to 30 days, if we ask before day 90 and give the reason; any other extension needs your written agreement. Tell us at least 7 days before you publish; that notice does not extend the deadline. If your report is a duplicate, the same clock runs from your own report, or earlier if the first reporter publishes. If we reject a report as invalid or out of scope, you may still publish your own findings on the same clock, but never personal data, live secrets, or non-public information you obtained from our systems. Do not publish other customers' or applicants' data. Do not demand payment in exchange for not publishing, and never threaten harm; you may still ask about a reward, challenge a decision or tell us your planned publication date. Your right to publish under this section does not depend on a reward. We may publish a summary of fixed issues.

10. Confidentiality and data

Customer and applicant data, and any other non-public information about Betterteam, that you encounter are confidential. If you encounter other people's data, stop; do not download or keep it. If evidence you already captured contains it, redact it, keep only the minimal redacted evidence the report needs, and delete the rest at once. Delete everything containing such data when the issue is closed. Your own proof of concept and notes without such data may be kept. Do not use such data or information for any other purpose, or share it with anyone except your own legal adviser and the co-reporters named in your report. This section covers that data and information, not the technical details needed to explain the vulnerability once section 9 allows disclosure, and it does not restrict disclosures the law requires or protects. Payment and tax details are handled under section 8.

11. Your report

You keep ownership of your report. You grant Betterteam a perpetual, worldwide, royalty-free license to use, copy and adapt it, including any proof-of-concept code and any fixes or mitigations you suggest, to understand, fix and improve our systems and to publish summaries, and to share it with the contractors and remediation partners who help us. You confirm that you have the right to submit the report and that you have told us about any third-party material in it; for that material, the license covers only what you have the right to grant. A reward under these terms is the only payment you can expect for it.

12. No other relationship

The program creates no employment, agency, partnership or joint venture between you and Betterteam. Taking part gives no right to future rewards or to the program continuing.

13. Changes and ending

We may change these terms, the scope or the reward table, or end the program, at any time by updating the Program page and this page. Changes and closure apply going forward only. This is the one version rule; other sections refer to it. Authorization, the scope and the rules for anything you did are the version in force when you did the research, whenever you report it. Rewards follow the reward table in force when you sent the report, except that a report sent within 14 days after a change or closure, about research done before it, uses the earlier table. A reward we have confirmed is paid even if the program ends. Effective date at the top; earlier versions on request.

14. Liability and disputes

The laws of the State of Delaware govern these terms. The dispute terms in our Terms and Policies, including binding arbitration, the class action waiver and the venue rules, are incorporated into these terms by reference. They bind you only when you accept these terms as section 1 describes; you can send a report, and rely on the safe harbor in section 3, without accepting them. We keep every dated version of these terms and of our Terms and Policies and will send you the versions you accepted. Under the conflict rule in section 1, these terms win, including the waiver in section 3. Nothing here limits any liability that the law does not allow to be limited.

15. Contact

Email: security@betterteam.com

Post: Betterteam Inc., 2093 Philadelphia Pike #2555, Claymont DE 19703-2424, United States.