Bug Bounty

Security and privacy are a primary concern for The Onion Router. Users who participate in our Bug Bounty Program are eligible for rewards in exchange for their detailed bug reports. Good job! 🎈

• Bugs are only eligible for the Bug Bounty Program if they can lead to or already cause the unintended leak of sensitive data and/or financial loss for The Onion Router.

• The Bug Bounty Program is not a channel for claiming ransom. Asking for payment in order to share bug reports will disqualify you from claiming your bounty reward.

• Any information relating to Bug must only be shared with The Onion Router privately through the correct channel to be eligible for the Bug Bounty Program. Users may contact anonymously.

• Bounty rewards are decided byThe Onion Router after a bug is confirmed. Amounts are set proportionate to the severity of the bug.

• Minimum payout: $250 USD equivalent in ($TOR)

SUBMISSION PROCESS:

Submit your detailed bug report and include:

• Full details of the bug you have found.

• Your cryptocurrency address for payment.

Following your submission we will investigate the bug to confirm the validity and severity of the report. If confirmed your bounty reward will be processed.

NOT ELIGIBLE:

The following reports are not eligible for bug bounty payouts:

• Cloudflare configuration (Firewall tuning, rate limiting, threat level settings, source blocking, etc)

• DDoS attacks/botnet attacks/other request flooding

Attempts to take down any The Onion Router service to gain a reward will be treated as extortion and a cyber crime and will reported to the relevant authorities. We do not negotiate with terrorists.