The Bugbounty platform provides these terms and conditions in order to familiarize you with the legal procedures and practices followed by us, which govern this platform and all related services, so please read and review these terms and conditions carefully before using this platform and your use of them is your express, unconditional and irrevocable consent that You adhere to these terms and conditions.
The term 'Bugbounty': refers to a vulnerability rewards program that provides services to the customer through the platform in connection with discovering vulnerabilities for websites, software, or others by researchers, and is granted financial rewards assigned when the vulnerabilities are discovered.
The term 'platform': refers to the Bugbounty platform owned by SAFCSP
The term 'client' refers to the subscribers of the platform, whether the owners of the sites, companies, government agencies, or otherwise, to benefit from the services of the platform in relation to the disclosure of vulnerabilities, and whether such services are requested directly or through a third party.
The term 'Researcher': refers to penetration testers registered on the Bugbounty Platform with the goal of discovering vulnerabilities and providing technical reports on them.
The term 'customer balance': refers to the amount of money that the client pays in advance to the platform for the purpose of deducting the rewards for the client's requirements that are paid to researchers, and deducting any compensation due to the platform under these terms and conditions.
Based on the terms and conditions stated, the BugBounty platform will allow the client to access and use the BugBounty service only for the purposes for which he was allocated by making use of the expertise and skills of researchers in discovering the Gaps.
The client can submit his requests to discover the Gaps for any of his sites or software through the platform in order to benefit from researchers and offer rewards for the Gaps’s reports.
Researchers can review the requests moi submitted on the platform by clients and provide reports on security Gaps according to the specific requirements and conditions specified by the platform in coordination with the requester client.
Any contract or other dealings outside the requests approved in the platform between the client and the researcher, the platform is not considered a party to such contracts or transactions and does not bear any responsibility arising from or related to it.
If you use the platform services on behalf of a company, client or legal entity, you acknowledge that you have full authority to take advantage of the platform services.
The BugBounty Platform is not responsible for any damage or problems arising from the client's communications or activities with the researcher or other clients, either through services or other independent transactions.
The platform ensures that all reports submitted by the researcher are checked, verifies their completeness, accuracy, and conformity with the client's criteria and evaluates them based on the list of rewards and Gaps. In the case that the researcher violates this, the platform has the right to make the appropriate decision regarding the report.
The platform is responsible for examining the programs that the client raises them, before they are presented to the researcher, and in the case of any deficiency, inaccuracy or reliability of any of the programs, the platform notifies the client of them to modify or enable the platform to modify them to ensure the protection of all parties from any damage that may occur as a result the use.
The platform takes a preliminary procedure regarding examining the Gaps’s report submitted by the researcher within (5) to (10) working days, unless this cannot be caused due to a violation of the will of those responsible for it.
It means that there is an inquiry and a request from the evaluation team on the platform, and the researcher must provide the required information within 7 days, and if there is no response within the specified period, the report will be closed and considered null and the researcher does not deserve any reward.
It means that the validity of the report has been verified by the platform and awaiting the customer’s approval of it within 40 working days. In the event that the client delays approval during the period, the status of the report will turn into 'Confirmed', and the customer is obligated to pay the reward to the researcher (if a reward is specified in the request). The client receives an inquiry or request, which the platform approves of, and the case turns into 'Needs more info'.
Means that the report has been approved by the customer. The client shall pay the reward to the researcher (if a reward is specified in the request).
It means that the report does not comply with the policies of the customer's request, or that it violated one of its conditions, or that it does not apply to this request.
It means that the report is awaiting customer review, and the customer is obligated to respond within 40 working days, and this case will be approved. After the verification process of the vulnerability and before the evaluation of the report in the event that there is any question of the evaluation team.
Means that the report is redundant and this vulnerability was previously reported.
It means that the report is less than the risk specified in the customer's request, and the report will not be displayed to the customer until the level of risk specified by him is modified.
Means that the report is outside the range specified by the customer.
It means that the report is not desirable, and this will negatively affect the researcher's evaluation, and his account will be suspended if this is repeated.
Researchers are independent third parties, who are not employees, contractors, or agents for the Gaps Bonus platform, who wish to participate in programs and communicate with the client through the platform services.
You acknowledge and agree that the platform does not bear any claims or compensation for damages that have arisen due to a client or other third parties in relation to the service provided to the client, including Gaps’s reports.
The services are provided by the platform 'as is' without any guarantee whatsoever, whether express or implied.
The platform publicly disclaims its responsibility to guarantee any business presented through the platform and its role is limited to enabling the client and the researcher to use the services without ensuring the platform to the quality of the services, either implicitly or explicitly.
The platform does not bear any direct or indirect damages (including damages resulting from loss of income, work, or profits), negligence, or otherwise.
After determining the foregoing, and after determining the damages mentioned above, is an essential element of the service between you and the platform, you acknowledge and agree that you use our email address at your own risk.
The platform agrees to process the rewards which are cash payments on behalf of the client. The platform also disclaims the platform for processing rewards that are not cash payments, or for delaying payment out of control.
The platform deducts the sums of bonuses to discover the gaps provided by clients to researchers on the platform from the client’s balance due to the completion of the client's requirements within thirty (30) working days from the date according to its absolute discretion and evaluation of the work provided by researchers without the client having the right to object to that.
The client must provide a balance in his account with the platform to the extent determined by the platform, and the client account or any of his requests will not be activated until the minimum required by the platform is provided.
The client agreed and delegated the platform irreversibly to pay the rewards from the client’s balance to researchers who report reports that they discover the gaps for the client’s requests, if they meet the conditions and requirements specified by the client, according to the platform’s own appreciation.
The client agrees to deduct twenty percent (20%) of the client’s balance in favor of the platform from each cash reward paid to the researcher, as it is a financial consideration due to the platform for its services.
The rewards paid are not refundable, except as specifically stated in the terms of the order submitted by the client (if any).
In the case that the client consider suspending the account on the platform, communication with the platform to stop the account and recover the remaining amounts in the client's balance without the right to recover the value of the subscription to the packages or any financial compensation due to the platform.
In the case that the client’s subscription period ends, the client has the option to renew the subscription or recover the remaining amounts in his balance, after communicating with the platform.
If the client’s balance is nearing end, the client will be notified to re-support the balance to cover any requests to the client regarding the vulnerability discovery, and no request will be placed on the platform unless there is sufficient balance to cover the costs related to that request.
All credit/debit cards details and personally identifiable information will NOT be stored, sold, shared, rented or leased to any third parties.
Saudi Arabia is our country of domicile
Website will NOT deal or provide any services or products to any of OFAC (Office of Foreign Assets Control) sanctions countries in accordance with the law of Saudi Arabia
We accept payments online using Visa and MasterCard credit/debit card in SAR.
Refunds will be done only through the Original Mode of Payment
Any dispute or claim arising out of or in connection with this website shall be governed and construed in accordance with the laws of Saudi Arabia.
During the registration process, the client must choose the appropriate package for him and proceed to the subscription payments. On the other hand, the platform shall provide all the specific features of the package chosen by the client during the subscription period.
Each of (the platform, the client, and the researcher) recognize that he/she may receive confidential information or data from the other party, and therefore the receiving party agrees not to disclose any secret information related to the other party nor using it for any purpose that not stipulated in the conditions, unless he obtains prior approval from the other party .
This excludes the consent of the client or the researcher that the platform may collect data regarding services and programs and report the total response rate, the total amounts paid and other total measures, as considered non-confidential information.
When you set up your account, you must provide us with accurate and complete information. This means that you cannot set up an account with a name or contact information that does not apply to you.
You must provide accurate and up-to-date information on all registration forms that are part of the platform's email address.
You can only set up one account.
Take full responsibility for your account and everything that happens on your account.
Report any suspicious account activity immediately.
You may not replace your account with another person.
You bear full responsibility as we are not responsible for any damages or losses caused by someone using your account without your permission.
Except as agreed by the two parties
The platform reserves the right to reject any request from the client for any reason whatsoever at its own discretion.
The client is solely responsible for managing his requests (software or website) through the services.
The client acknowledges and undertakes that he owns all the materials specified in his request submitted through the platform and that he has all the rights necessary to grant the platform the rights to discover gaps in these materials under the conditions.
The client acknowledges and undertakes not to violate the materials of the current platform or that will be provided later through the services and not to use it, misuse or violate the intellectual property rights of the third party, publicity or privacy rights, or what leads to violating any applicable system or regulation.
The platform gives you a non-exclusive, non-transferable, and revocable license to access and use our email address according to our legal terms. Your use of our website is only for the purposes stipulated in our legal terms; any other use that is in violation of this license will result in your membership being canceled.
When any request of the client is inactive or not monitored by the client, the platform has the right to remove or disable access to any of the relevant program or vulnerability reports in the case of that the client does not respond to the written vulnerability platform notice (via email) within 3 working days of this notice.
The Gaps Rewards platform reserves the right to suspend or discontinue the availability of the site or any service or remove any software at any time at its sole discretion and without prior notice.
The client or researcher is responsible for reviewing and getting acquainted with any of the amendments on any of the conditions, provisions or policies announced on the site.
Use of any service provided by the platform signifies your acceptance of the revised terms. In addition, when using certain features of the services, you are subject to any published guidelines, and the terms of the rules applicable to these services.
Your access to the platform and your use of the site may be interrupted, from time to time as a result of its maintenance, or for any other reason, inside or outside our control.
The platform may also impose new restrictions on services or features offered by the platform that restrict your access to all or part of the services without prior notice.
Our website may contain trademarks related to the platform or the Federation or trademarks as well as the marks of our subsidiaries or other companies, in the form of words, graphics and logos.
Your use of our website does not represent any right or license for you to use any marks, services or trademarks, without obtaining prior written permission from the owner of the service mark / trademark owner.
Your use of our website does not grant you property rights of any kind on our website.
When you join the platform and complete the registration process, you agree to use only the legitimate purposes for which it was designated, and you acknowledge that you know our legal conditions and adhere to and adhere to them completely, and therefore you agree to:
Not to misuse the platform in any way unauthorized.
Not to represent others or claim that there is any relationship, representation or representation for any company or legal entity except with a legal agency or a statutory mandate.
Do not change or delete any content from the contents of the platform.
Not to prejudice or publish any material that violates intellectual property rights or any other rights.
As a condition of use, you acknowledge that: Not to use the service provided by the platform for any purpose that is unlawful or prohibited under these client terms, or for any other purpose that the platform does not intend. By way of example, and not as a limitation, you agree not to use the service provided for:
Abusing, harassing, threatening, impersonating or intimidating anyone.
Posting, transmitting, or causing publication and transmission, any defamatory, pornographic, or offensive content that violates any copyright or other right of any person.
Communication with company representatives, researchers, and other clients in an abusive manner.
Posting, sending, or causing the publication or transmission of any contact designed or intended to obtain a password, account or private information from any user of the Vulnerability Bonus Platform with a view to harming them.
Use of client vulnerability reports to violate third party intellectual property rights, publicity or privacy rights, or in violation of any law or legal regulation.
The researcher also adheres to all the policies stipulated in the platform, and this includes the policies of loopholes for clients ’programs, and the researcher acknowledges that if he violates any of these policies, he completely waives his right to claim the rewards of the reports he provides. In the case that his violation results in any direct or indirect harm to the client or the platform, he bears full responsibility, and legal systems and regulations for information crimes will be applied.
This platform is subject to all laws and regulations in force in the Kingdom of Saudi Arabia, and the courts of the city of Riyadh alone are competent to separate all disputes that may arise from the use of this platform.
Terms of use and modifications apply from the date of publication, and the platform reserves the right to amend the terms, conditions and policies every now and then , and the site user is responsible for reviewing the terms of use every now and then to ensure that it adheres.
The platform does not disclose your personal information with other people or other parties except to provide some content or services for the purposes for which it was intended, and based on your agreement to this policy, or under the following circumstances:
What requires disclosure by force of order or by judicial order.
What requires disclosure to the executive authorities according to a reasoned decision.
To protect our property, services and statutory rights; or to enforce our terms of use.
To comply with any applicable regulations.
Disclosure to the platform’s partners, affiliates, or contractors to provide services for the platform.x
As a requirement for participation in the BugBounty platform, researchers must refrain from disclosing or sharing the discovered vulnerabilities or any related vulnerability information outside the platform's scope. This restriction is imposed to safeguard the security of users and relevant systems and to prevent the dissemination of sensitive information. In the event of violating this requirement, the platform will take legal or administrative actions against the researcher.By participating in the BugBounty platform, you agree to the following terms and conditions:
Non-Disclosure of Discovered Vulnerabilities: As a researcher on the platform, you are prohibited from disclosing or sharing any vulnerabilities you discover in the participating software outside of the BugBounty platform. This includes any related vulnerability information, technical details, or proof-of-concept code.
Written Consent Requirement: Without obtaining explicit written consent from the administration of the BugBounty platform , you are not permitted to publish, share, or communicate any vulnerability information related to the participating software, including but not limited to blogs, forums, social media, or any other public or private channels.
Legal Consequences of Non-Compliance:Failure to adhere to these terms shall result in legal action being taken against you In accordance with the regulations and laws in the Kingdom of Saudi Arabia. The administration of the platform reserves the right to pursue all available legal remedies in cases of violation, which may include among others seeking damages, injunctive relief, and recovery of legal fees.
This Bugbounty Non-Disclosure Clauses is in place to ensure the security and integrity of the participating software, protect users and their data, and prevent the unauthorized distribution of sensitive information. By participating in the platform, you acknowledge and accept these terms and the potential legal consequences of violating them. Please carefully review and understand these terms before engaging in any research activities on the BugBounty platform.By proceeding with your research activities on the BugBounty platform, you acknowledge that you have read, understood, and agreed to abide by the terms and conditions outlined in these clauses. Failure to comply with these terms may result in serious legal consequences.
These terms and conditions and any of the conditions stated in the client’s requests that refer to the terms of full and exclusive understanding between the platform and the client or researcher and replace all oral or written understandings or agreements between the platform and the client or the researcher regarding services, any notices or other correspondence submitted By the platform under the terms, including those related to modifications to the terms, by e-mail and by posting on the platform's website.
You must ensure that the details provided upon registration are correct and complete.
This web page is a legal document that acts as our Terms of Service, and it also governs the legal terms of our website, https://BugBounty.sa, subdomains, and any related applications across the web and mobile applications.
The terms mentioned in these terms have the meaning specified in the definitions and interpretations section above, unless specified otherwise.
These terms of service or other rules published on our site on the platform (including these terms and conditions and the security and privacy policy) constitute 'legal terms', as it is the full and only agreement between the researcher or the client and the platform, and it replaces all other agreements, guarantees and understandings regarding our website.
The most recent versions of our legal terms will be published on our site, and you must review all legal conditions before using our site.
The researcher is obliged during his activities on the platform with all the materials, clarifications and instructions that are in the scope of work for the client, and acknowledges his full commitment to it, and in case of his violation of any of the materials, clarifications or instructions in the scope of the work of the client and explained in his programs on the platform, he is subject to legal accountability According to the regulations of cybercrime regulations, he loses his full right to claim rewards for the reports he submitted in those programs.