Bug bounty program

Phase: private, invite-only.

Why invite-only? Two reasons.

• We want signal, not noise. A small invited cohort of experienced researchers produces fewer duplicates and fewer automated-scanner reports than an open program.
• We need to reliably triage what comes in. meandai is single-operator; a flood of low-quality submissions is worse than no submissions.

We expect to expand to a public program 6–12 months after the second annual external pentest, once our triage capacity is proven.

Two paths:

1. Intigriti reputation. If you have a verified Intigriti profile with established triage history (rough bar: 10+ accepted reports across other programs), email security@meandai.io with your handle and we’ll invite you on Intigriti.
2. Reported via responsible disclosure first. Submit a high-quality finding via our responsible disclosure process. If we accept and ship the fix, we’ll invite you to the bug bounty program for future research.

Awards are paid in EUR via Intigriti, on accepted, in-scope findings, after the fix is verified. Severity is determined by meandai using CVSS v3.1 + business impact; we’ll explain the rationale on each finding.

Bonus multipliers: chained findings (multi-step exploit chains) up to 1.5×; finding that prompts an architectural change up to 2×; first reporter on a duplicate gets the full bounty, late duplicates get nothing.

Same as responsible disclosure scope. The bug bounty program does not add new targets — it adds payment for the same set of findings.

Out of scope: see responsible disclosure. Note especially: automated-scanner output without manual verification, DoS, and social engineering are firmly out.

• Acknowledgement: 5 business days (typically <72h).
• Severity assigned: within 7 business days of acknowledgement.
• Fix scheduled: P0 within 24h, P1 within 7 days, P2 within 30 days, P3 within 60 days or risk-accepted with rationale shared with the reporter.
• Payment: within 14 days of fix verification.

We’ll mark findings as not-applicable for these reasons:

• Out of scope per the responsible disclosure list.
• Duplicate — first reporter gets the bounty.
• Already known — if we have it in the remediation log or it’s been disclosed in a prior pentest, no bounty (we’ll show you the proof).
• Not exploitable — theoretical findings without a working repro do not qualify.
• Tested on user data — if you used another customer’s account or data without consent, this voids the bounty AND the safe-harbour.

Researchers who submit accepted findings are invited to the hall of fame with their preferred handle (or anonymous).