AarMe in two minutes
Rewards
Severity is set by the CyberAar final score: CVSS v4 crossed with the demonstrated business impact. The amount belongs to each programme: it depends on the criticality of the asset hit and is published when the programme opens. Payment via Wave, Orange Money or PayPal.
Each programme's ranges are on its page; the detailed calculation is sent with every acceptance. See the programmes See the rules
Process
Defines scope, assets to test, engagement rules and applicable severity levels.
Bug Hunters explore the authorised scope and submit structured reports: description, reproduction steps, impact, proof.
Every report is triaged and qualified by CyberAar. Validated findings lead to FCFA payment via Wave, Orange Money or PayPal.
Organisations
Complement periodic audits with continuous evaluation. Attack surfaces evolve constantly - surveillance must keep pace.
You only pay for vulnerabilities validated by CyberAar. Every finding is qualified and proven exploitable before any payment.
Restrict testing to a curated set of vetted, invite-only hackers. The programme and its assets are invisible to non-invitees - access delivered over a dedicated VPN tunnel. Ideal for banking systems, ERPs and critical infrastructure.
CyberAar triages and qualifies every report before forwarding. You receive actionable reports, no noise.
Scope
Every asset is classified before any report, on seven criteria (business criticality, data, privileges, financial transactions, blast radius, dependencies, safety): Standard, Important, Critical or Crown Jewel. The higher the class, the higher the reward range.
Hackers
Public and private programmes, impact-proportional rewards, public recognition.
Bounties set by asset criticality and CVSS severity. Wave, Orange Money or PayPal payment per validated finding.
The Hall of Fame is reserved for critical findings. Public ranking, permanent recognition.
Exceptional hunters receive exclusive CyberAar merch: t-shirts, hoodies, gear - on top of bounties.
Transparency
AarMe runs on a simple principle: each party sees what concerns them. No black box, no arbitrary decisions.
Organisations
Hackers
Organisations
Not a raw scanner alert. A finding reproduced, qualified and rated by a CyberAar engineer before it reaches you. You only pay for what clears that filter.
Illustrative example
Qualified within 5 working days · Identity-verified researcher · Replayed before hand-off
Sign up
The CyberAar programme is open. Create your account and get your identity verified: validation is required before you hunt.
Join the AarMe community on Discord
Download the report template, follow programme announcements and talk with other researchers.