Bug Bounty Program

Researchers around the world are welcome, subject to applicable laws and payment restrictions. You must be at least 18 years old and follow the testing guidelines below.

Adaptive employees, contractors, and anyone directly involved in building or assessing the affected system are not eligible for rewards for that work.

In scope

• Adaptive's hosted application, including the Adaptive-operated APIs it exposes.
• Security boundaries in these services, including organization isolation, roles, approval workflows, credentials, and access policies.

Test using accounts, organizations, and resources that you own or have explicit permission to use. If you are unsure whether an asset is covered, email us before testing.

Out of scope

• Customer-owned infrastructure, databases, cloud accounts, and self-hosted deployments without separate written authorization.
• Third-party services, identity providers, and integration targets. A flaw in Adaptive's handling of an integration may qualify; a flaw in the third-party service itself does not.
• Domains, subdomains, and environments not listed above.
• Cosmetic or functional bugs, unsupported theoretical attacks, and best-practice recommendations without a working exploit and a demonstrated security impact.

Keep your research focused on the smallest demonstration needed to establish a security issue.

• Use your own test accounts and synthetic data. Never access, download, change, or delete another person's data.
• Avoid service disruption, denial-of-service testing, high-volume scanning, credential stuffing, and brute-force attacks.
• Do not use phishing, social engineering, physical attacks, or unsolicited messages to employees or customers.
• Do not establish persistent access, move into other systems, or run destructive commands.
• If you encounter sensitive data unexpectedly, stop testing and report the exposure immediately. Do not include secrets or personal data in attachments.

Participation does not authorize testing outside this scope or activity that violates applicable law. Contact us before proceeding if a proof of concept would require broader access.

Email security@adaptive.live with a subject beginning with Bug bounty report. Include:

1. A clear title and the affected URL, endpoint, or feature.
2. The setup, permissions, and exact steps needed to reproduce the issue.
3. A minimal proof of concept, with redacted screenshots or request and response examples where helpful.
4. The security boundary crossed and the impact you demonstrated.
5. Your contact details and any relevant test account identifiers.

Our team will review the report, reproduce the finding, and follow up if more information is needed. Please keep related findings and follow-up evidence in the same email thread.

Rewards apply to the first complete, reproducible report of a previously unknown, in-scope vulnerability. Multiple reports with the same root cause are evaluated as one finding.

Adaptive assesses severity using the demonstrated impact, the access an attacker needs, and the affected security boundaries. The examples above are illustrative; a vulnerability name alone does not determine its severity.

Duplicate reports, known issues, findings without meaningful security impact, and reports that violate these guidelines are not eligible. For accepted findings, we will confirm the classification, reward, and payment arrangements directly with the researcher.

Keep vulnerability details, proof-of-concept material, and any non-public information private while we investigate and resolve the issue. Coordinate publication with us before sharing a report or demonstrating an exploit publicly.

We value clear, careful research that helps protect our customers. Questions about scope, reporting, or an existing submission can be sent to security@adaptive.live.