Vulnerability Reward Program

What happens after your report

Our developers will look into the matter, and will make a determination whether your finding actually is a security vulnerability and if we can reproduce it with the information you supplied. If it qualifies, a reward will be paid after the issue has been fixed.

We cannot commit to any specific fixing (and as a result, reward payment) schedule as each case is different. However, we internally give high priority for externally reported security issues, and we will aim to keep you updated on the status. You may also ask for status updates by contacting your case handler.

We may at times publish the names of people we have rewarded, and if we publish any vulnerability bulletins, we'd like to give credit where it's due. If you would rather stay behind an alias (handle) or anonymous, we will of course respect that.

Although we will try to see the issue with your eyes, in some edge cases, we might be of the opinion that the issue you found does not pose a risk or the issue is not a security or privacy bug. In these cases, a reward will not be paid.

A reward will not be paid if the finding becomes public, in any way, before it is fixed. If someone else has already reported the finding earlier, we will let you know after the issue has been fixed. If several researchers report the same issue, we only reward the sender of the first report that provides us with enough technical details to reproduce the finding. We know that this would give us a loophole to claim that everything's been already previously found, but trust us, we want to be fair.

Rewards 

The size of the reward is solely determined by an WithSecure team consisting of our technical staff, and is based on the estimated risk posed by the vulnerability. The current reward range is from EUR 100 to EUR 15,000.

If you report several issues that are duplicates in different parts of the service (e.g., the same code running on different nodes or platforms), or part of a larger issue, these may be combined into one and only one reward may be paid.

The following table provides several bug classes and their corresponding bounty. While not all bug classes are covered by this list, you may get a sense of severity vs. reward by examining the following examples.

Payments

IMPORTANT! Please do not send your payment information to us up front. We will ask for the appropriate information if and when a payment is due.

Payments are made as bank transfers within the Single Euro Payments Area (SEPA) or international bank (wire) transfers outside the SEPA. We cannot use checks, cryptocurrencies, or use any other money transfer services. The payment recipient is responsible for any charges or fees levied on the transfer, and for accessing the funds once transferred. Payments are by default done in Euros (EUR) and any currency conversions are done at the current bank rate.

We are required to report all individual researchers' rewards to the Finnish Tax Administration irrespective of where you live. In order to do this, and to actually pay, we would later request your full name, date of birth and a current physical mail address, and your bank (wire) transfer details. If you have a company, we may request that you invoice us instead.

The recipient is responsible for any taxes. If you are taxed in Finland, we are required to collect the withholding tax, and require your personal ID number and optionally your taxation certificate for the current year.

These identification requirements are imposed on us by the authorities, and we cannot make any exceptions to these. In addition, payments are not made to countries or jurisdictions that are under embargo, or to persons or entities on a sanctions list.

Due to these identification requirements, we will only deal with the original reporter directly. We will only use the email address in the original report, so ensure you have continued access to the email account you used to send the initial report.

Further legal statements

Our lawyers want us to point out the following small print:

You may reverse-engineer and decompile WithSecure clients strictly and solely for the purpose of conducting security research for this vulnerability reward program. This permission applies only to WithSecure clients explicitly named and listed in this vulnerability reward program, excluding any licensed third party components therein. You may not disclose, show or publish to any third parties any code or parts thereof in any form you have derived resulting from this permission.

A description of the personal data record used for reward payments is available here.

WithSecure reserves the right to discontinue this reward program and change its terms at any time without prior notification. This text was last modified on 2022-01-05. Unless specifically extended here, the current vulnerability reward program will end on 31st December 2022. All decisions regarding reward payments are final. The rules of this reward program or any communication related thereto do not provide or imply any obligations to WithSecure of any kind.