Bug Bounty Program
Last updated: September 22, 2026
Royaltyport B.V. ("Royaltyport") values the work of security researchers. If you believe you have found a security vulnerability in one of our services, we encourage you to report it to us privately so we can fix it before it can be exploited. Valid reports that follow this policy are eligible for a modest reward.
1. How to report
Email your report to security@royaltyport.com. Please include:
- a description of the vulnerability and its potential impact;
- the affected URL, endpoint, or component, and clear steps to reproduce it;
- any proof-of-concept code, screenshots, or requests; and
- how you would like to be credited, if at all.
We aim to acknowledge your report within 2 business days. We then confirm and assess it within 1 business day for critical issues, 3 business days for high, and 10 business days for everything else. We will keep you informed while we work on a fix.
2. Scope
In scope:
app.royaltyport.com(the Royaltyport platform);- the Royaltyport API and MCP server; and
royaltyport.com(this website).
Out of scope:
- third-party services we use (such as hosting, email, analytics, or the status page) — please report those to the vendor directly;
- denial-of-service, load testing, spam, or social engineering of our staff, customers, or partners;
- physical attacks against our offices or infrastructure;
- findings from automated scanners without a demonstrated, exploitable impact;
- missing security headers, cookie flags, SPF/DKIM/DMARC records, or TLS configuration best practices without a concrete exploit;
- clickjacking on pages without sensitive actions, logout CSRF, or self-XSS;
- rate-limiting issues, user enumeration, and vulnerabilities that require an already-compromised device or account.
3. Rules of engagement
- Only test against accounts you own or have explicit permission to use. Never access, modify, or delete data belonging to other users or organizations; if you accidentally do, stop immediately and tell us.
- Use the minimum access needed to demonstrate the issue. Do not download or retain more data than necessary, and delete anything you obtained once reported.
- Do not degrade the availability of our services or harm other users.
- Keep the vulnerability confidential until we have fixed it and agreed to disclosure with you.
- Do not demand payment in exchange for withholding or disclosing a finding.
4. Rewards
We are a small team, so our rewards are modest. The amounts below are guidelines; the final severity and reward are determined by Royaltyport based on real-world impact and the quality of the report.
| Severity | Reward | Examples |
|---|---|---|
| Critical | €500 | Remote code execution, full authentication bypass, access to another customer's data at scale. |
| High | €250 | Accessing or modifying another organization's contracts, statements, or files; privilege escalation to admin. |
| Medium | €100 | Stored XSS in the platform, CSRF on a sensitive action, limited information disclosure. |
| Low | €50 or a public thank-you | Minor issues with a demonstrable, if limited, security impact. |
- Only the first report of a given vulnerability is eligible. Multiple reports with the same root cause count as one.
- Rewards are paid by bank transfer or PayPal after the issue is confirmed. You are responsible for any taxes on the reward.
- We cannot pay rewards where prohibited by law or sanctions, to current or former Royaltyport employees or contractors, or to reports that breach this policy.
- Rewards are discretionary. This program may be changed or ended at any time, and participating does not create an employment or contractor relationship.
5. Safe harbor
If you make a good-faith effort to comply with this policy, we consider your research authorized, will not pursue or support legal action against you for it, and will work with you to understand and resolve the issue quickly. If a third party takes legal action against you for activity that complied with this policy, we will make it known that your actions were authorized by us.
6. Contact
Send reports and questions about this program to security@royaltyport.com. Our machine-readable contact details are published at /.well-known/security.txt.