---
title: "Bug bounty"
description: "The MainSDK bug bounty: what is in scope, what we pay, and the safe harbour for good-faith research."
section: "community"
status: "Planned for 0.5"
spec: "community-launch"
canonical: "https://mainsdk.dev/docs/community/bounty"
updated: "2026-10-28"
---

# Bug bounty

> The MainSDK bug bounty: what is in scope, what we pay, and the safe harbour for good-faith research.

Status: Planned for 0.5 · Canonical: https://mainsdk.dev/docs/community/bounty · Updated: 2026-10-28

We pay for vulnerabilities in MainSDK itself from public beta day. Report through the programme: [Report through GitHub private vulnerability reporting](https://github.com/hubxero/mainsdk/security/advisories/new). Read the [security policy](security.md) first: it gives the disclosure rules and the fix times.

## Scope

**In scope**

- the packages mainsdk, "@mainsdk/cli", "@mainsdk/core" and "@mainsdk/testing"
- their release artifacts, signatures and provenance
- the release workflow
- the docs site and its build

**Out of scope**

- apps built with MainSDK (report to their owners)
- third-party drivers published by their authors
- social engineering, denial of service by volume and physical attacks
- findings that need a modified or already-compromised machine

## Rewards

We set the reward by the CVSS 4.0 severity we confirm, and pay at the top of the range for a report with a working proof and a suggested fix.

| Severity | Reward (USD) |
| --- | --- |
| Critical | 2,000 to 5,000 |
| High | 750 to 2,000 |
| Medium | 250 to 750 |
| Low | 100 |

## Safe harbour

If you act in good faith and follow this page and the [security policy](security.md), we will not start legal action against you and will not ask a platform to remove your research. Good faith means:

- You test only your own installs and accounts, and stop as soon as you see another person's data.
- You do not degrade a service, keep data you reached by accident, or publish before the fix and the advisory.
- You report through the programme link above and give us a reasonable time to fix, within the times in the policy.

We will credit you in the advisory unless you ask us not to. This is a statement of intent by the maintainers; it cannot bind third parties such as hosting providers.