Bug Bounty Program Policy

Governs WEBSPACEAI's paid bug bounty program.

In-scope domains, APIs, and applications per published program page.

Eligible Report.

Rewards tiered by severity (CVSS-based): Critical, High, Medium, Low. Duplicate/out-of-scope reports ineligible. [FIX] Prompt injection and agent-permission-bypass vulnerabilities in WSAI CODE are now an explicitly in-scope, premium-reward category given their elevated risk profile.

Security administers program and payouts; Finance processes payments.

Program terms published and updated at the Security Center.

Rule violators permanently disqualified.

bugbounty@webspaceai.in

Reward disputes reviewed within 10 business days.

Annual.

bugbounty@webspaceai.in