Profile Photo
Incoming call
Security

Bug bounty programme

We take the security of SupervisorSync seriously. If you find a vulnerability, we want to hear from you — and we reward responsible disclosure.

Rewards from $50 to $5,000 Acknowledged within 48 hours Safe harbour for good-faith research

Rewards

Validated vulnerabilities earn between $50 and $5,000, based on severity, impact and the quality of the report. Bounties are paid within 7 business days of resolution, by bank transfer or your preferred method.

CriticalHighest tier
HighUpper tier
MediumMid tier
LowFrom $50

Scope

In scope

  • supervisorsync.com, the web app and its API endpoints
  • Sign-in, registration, password reset and payment flows
  • Admin, supervisor and student portals
  • File uploads and resource management
  • Access control, privilege escalation and cross-school data access

Out of scope

  • Third-party services (payment, email, hosting providers)
  • Social engineering or phishing against our team
  • Denial-of-service attacks
  • Physical or device-access attacks
  • Informational findings with no demonstrable impact
  • Issues in third-party dependencies we don't control

To qualify, a report must be new to us and include clear, reproducible steps with a proof of concept.

Rules of engagement

By taking part, you agree to:

  • Test only against your own accounts — never access, change or delete other users' data
  • Go no further than needed to confirm the issue
  • Delete any data obtained during testing once you've submitted
  • Keep details confidential until we confirm the fix
  • Give us reasonable time to fix the issue before any public disclosure
Public disclosure. Bounties are paid only for issues that haven't been disclosed publicly before we've fixed them. If a finding has been published, it must be taken down before payment. We won't pursue legal action against researchers who follow these rules and act in good faith.

What happens next

1

Submit

Use the form, or email hello@supervisorsync.com with details and a proof of concept.

2

Triage

We acknowledge within 48 hours and confirm severity within 5 business days.

3

Fix

Our engineers fix the issue and keep you updated along the way.

4

Reward

Your bounty is paid within 7 business days of the fix.

Report a vulnerability

Our security team reviews every submission and responds within 5 business days.

Report received

Thank you for helping keep SupervisorSync secure. We'll review your submission and reply within 5 business days. If your finding is valid, we'll be in touch about your reward.

Safe harbour: we won't pursue legal action against researchers who follow these rules and act in good faith. Protected by reCAPTCHA — Google's Privacy Policy and Terms apply.