Bug Bounty Program

Why TurboPentest Has a Bug Bounty

A security platform must hold itself to the highest security standards. TurboPentest's bug bounty program invites the security community to test the platform itself and report vulnerabilities responsibly. If we ask you to trust us with your pentesting, we must prove our own security posture is robust.

The program is open to all security researchers. You do not need to be a TurboPentest customer to participate.

Scope

In Scope

The following assets are in scope for the bug bounty program:

• Web Application - turbopentest.com (all routes including /api, /learn, etc.)
• REST API - All https://turbopentest.com/api endpoints
• Authentication System - Login, registration, session management, OAuth flows
• Webhook System - Webhook delivery, signature verification, callback handling
• MCP Server - The npm-distributed MCP server package
• GitHub Action - The integsec/turbopentest-action GitHub Action
• Payment Processing - Stripe integration, credit purchasing, and billing flows

Out of Scope

The following are explicitly excluded:

• Phase 1 Tools - Vulnerabilities in the underlying third-party scanning engines should be reported to their respective maintainers
• Paladin Agents - The AI agents themselves (prompt injection against the pentesting agents is not a vulnerability in TurboPentest)
• Social Engineering - Phishing, pretexting, or social engineering attacks against TurboPentest employees
• Denial of Service - Volumetric DoS or DDoS attacks
• Third-Party Services - Vulnerabilities in Neon, Upstash, Vercel, or other infrastructure providers
• Previously Reported - Issues already reported by another researcher and under remediation

Severity Tiers and Recognition

Every valid report is assigned a severity tier, and recognition scales with that tier. TurboPentest records a single rewardTier on each report and recognizes researchers at its discretion - there is no fixed, guaranteed per-severity credit payout. The tiers below describe the classes of vulnerability, from most to least impactful; treat any specific reward as discretionary recognition, agreed case by case, not an automatic scale.

Critical

Vulnerabilities that could lead to:

• Remote code execution on TurboPentest infrastructure
• Access to other users' pentest results or account data
• Bypass of authentication to access any user's account
• Access to stored payment information or billing data
• Compromise of the webhook signing mechanism allowing forged notifications

High

Vulnerabilities that could lead to:

• Privilege escalation (regular user gaining admin access)
• Stored XSS that executes in other users' sessions
• IDOR (Insecure Direct Object Reference) exposing other users' data
• API authentication bypass
• Credit manipulation (spending others' credits or generating free credits)

Medium

Vulnerabilities that could lead to:

• Reflected XSS requiring user interaction
• CSRF on sensitive actions (password change, email change, API key generation)
• Information disclosure of non-sensitive internal data
• Rate limiting bypass on sensitive endpoints
• Insecure default configurations

Low

Vulnerabilities that could lead to:

• Missing security headers (with demonstrated impact)
• Verbose error messages revealing stack traces or internal paths
• Subdomain takeover on non-sensitive subdomains
• Email enumeration via login or registration endpoints
• Missing best practices with minimal security impact

Informational (acknowledged, no reward)

• Theoretical vulnerabilities without a proof of concept
• Issues requiring unlikely or impractical attack scenarios
• Best practice recommendations without security impact

Reporting Process

How to Submit

1. Use the in-app form - Submit your report through the bug-bounty submission form on the security page at turbopentest.com/security. Submissions post to the /api/bounty/submit endpoint and are run through an AI triage step before a human reviews them.
2. Include - A clear description of the vulnerability, steps to reproduce, proof-of-concept (screenshot, video, or code), and the potential impact
3. Do not - Exploit the vulnerability beyond what is necessary for the proof of concept. Do not access other users' data, exfiltrate data, or cause service disruption.

Report Template

Use this structure for your report:

**Title**: [Brief description of the vulnerability]

**Severity**: [Your assessment: Critical/High/Medium/Low]

**Affected Asset**: [URL, endpoint, or component]

**Description**: [Detailed explanation of the vulnerability]

**Steps to Reproduce**:
1. [Step 1]
2. [Step 2]
3. [Step 3]

**Proof of Concept**: [Screenshots, video, or code]

**Impact**: [What an attacker could achieve]

**Suggested Fix**: [Optional but appreciated]

Response Timeline

• Acknowledgment: Within 24 hours of submission
• Triage: AI triage runs on submission, then a human confirms validity and assigns a severity tier (target: within 3 business days)
• Fix: Depends on severity - Critical (24 hours), High (7 days), Medium (30 days), Low (90 days)
• Recognition: Discretionary, based on the assigned tier and agreed case by case after the fix is deployed
• Disclosure: Coordinated disclosure allowed 90 days after fix, or earlier with mutual agreement

Responsible Disclosure

TurboPentest follows a coordinated disclosure model:

• Do not disclose publicly until the fix is deployed and the disclosure window has passed
• Do not test against other users' accounts - Create your own test accounts
• Stop testing if you access real user data - Report immediately and do not proceed further
• Do not automate at scale - Manual testing with reasonable request volumes only

Researchers who follow responsible disclosure practices receive public acknowledgment (with permission).

Public Recognition

Roadmap - security hall of fame. A dedicated public hall-of-fame page listing researchers who responsibly disclosed valid vulnerabilities is planned, but no such route exists yet - the security page (turbopentest.com/security) currently hosts the program overview and the submission form only. Until it ships, recognition is arranged directly with the researcher (with their permission).

Public acknowledgment requires:

• A valid, in-scope report
• Following responsible disclosure practices
• Opting in to public acknowledgment

Bug Bounty Hunter Discord Role

Researchers who submit at least one valid report earn the Bug Bounty Hunter role on the TurboPentest Discord server. This role provides recognition and access to the #bug-bounty channel for discussing security research methodology with other hunters.