# Security bounty program

We highly value the contributions of researchers in helping us keep our platform safe. Through our security and bug bounty programs, we reward those who responsibly disclose vulnerabilities with [$SNSY tokens](https://www.snsy.ai/).

## Rewards

Rewards are paid in $SNSY tokens based on severity

### Critical

$500 - $5k  
*equivalent

### High

$200 - $2k  
*equivalent

### Medium

$100 - 1k  
*equivalent

### Low

$100 - $500  
*equivalent

## In-scope vulnerabilities

- Cross-Site Scripting (XSS)
- SQL Injection
- Remote Code Execution
- Authentication Bypass
- Insecure Direct Object References (IDOR)
- Server-Side Request Forgery (SSRF)
- Business Logic Vulnerabilities
- Access Control Issues
- Critical Information Disclosure
- CORS Misconfigurations

## Out of scope

- Theoretical vulnerabilities without proof
- Social engineering attacks
- DoS/DDoS attacks
- Rate limiting issues
- Missing security headers (unless exploitable)
- Self - XSS
- Clickjacking without clear impact
- CSV injection
- Known public security issues
- Issues requiring physical access
- Findings from automated tools w/o manual verification
- Vulnerabilities in third-party services

Want to apply? Make sure you read our [Terms and Instructions](https://sensay.io/security-bounty-program).

# Bug bounty program

We value community contributions in identifying issues that improve our platform’s quality. Our general bug bounty program rewards users who responsibly report functional, usability, and performance issues with [$SNSY tokens](https://www.snsy.ai/).

## Rewards

Rewards are paid in $SNSY tokens based on severity

### Critical

$500 - $5k  
*equivalent

### High

$200 - $2k  
*equivalent

### Medium

$100 - 1k  
*equivalent

### Low

$100 - $500  
*equivalent

## In-scope vulnerabilities

- Functional Errors
- UI/UX Issues
- Performance Problems
- Localization and Accessibility Issues
- Cross-browser Compatibility Issues
- Mobile Responsiveness Problems
- Incorrect or Missing Content

## Out of scope

- Security vulnerabilities (report to security bounty program)
- Suggestions for new features
- Subjective design feedback
- Issues caused by unsupported browsers or outdated versions
- Non-reproducible issues
- Bugs in third-party services

Want to apply? Make sure you read our [Terms and Instructions](https://sensay.io/bug-bounty-program).

# Feature bounty program

We reward innovative feature contributions that enhance Sensay.io’s functionality, user experience, and scalability. Rewards are determined by the complexity, impact, and alignment with our product roadmap, with payouts ranging from $1,000 to $10,000, paid in [$SNSY tokens](https://www.snsy.ai/).

## Rewards

Rewards are paid in $SNSY tokens based on severity

### Transformative

$7k - $10k  
*equivalent

### High

$200 - $2k  
*equivalent

### Medium

$100 - 1k  
*equivalent

### Low

$100 - $500  
*equivalent

## In-scope vulnerabilities

- New integrations with popular platforms
- Automation that reduces manual work
- UX/UI improvements that drive engagement
- Scalability and performance enhancements
- Features that improve collaboration and communication

## Out of scope

- Features misaligned with the product roadmap
- Cosmetic changes without functional impact
- Duplicates of existing features
- Features that compromise user privacy or security

Want to apply? Make sure you read our [Terms and Instructions](https://sensay.io/feature-bounty-program).