Scope

Assets in scope

Asset URL Asset class

AarMe Platform aarme.cyberaar.io Critical (58.3/100)

Form API cyberaar.io/api/* Standard (28.3/100)

Main website cyberaar.io Standard (11.7/100)

Rewards

Bounty table

Reward based on the CyberAar final score (CVSS v4.0 × business impact) and the asset class.

How the amount is calculated (CyberAar method): 1. the technical severity is the CVSS v4.0 Base score; 2. the demonstrated business impact is scored from 0 to 10 by a weighted questionnaire (financial, data, control, continuity, regulatory, scope, safety); 3. the final score is √(CVSS × impact), to one decimal, and sets the final severity (Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10; below 4.0, no reward); 4. the class of the targeted asset, set before any report, selects the range, and the exact final score sets the position within it (rule of three), rounded to 5,000 FCFA. Programme Bounty Max: 500,000 FCFA; no asset of this programme is classed Crown Jewel. The detailed calculation is given on acceptance. Applies to reports decided from 6 October 2026.

Hall of Fame: entry is reserved for findings of critical severity. Other severities are rewarded per the grid below, without a Hall of Fame listing.

Final severity (score)	Standard	Important	Critical	Crown Jewel
Critical 9.0 - 10.0	75,000 - 125,000 FCFA · 15-25 %	125,000 - 225,000 FCFA · 25-45 %	225,000 - 300,000 FCFA · 45-60 %	300,000 - 500,000 FCFA · 60-100 %
High 7.0 - 8.9	25,000 - 75,000 FCFA · 5-15 %	75,000 - 125,000 FCFA · 15-25 %	125,000 - 200,000 FCFA · 25-40 %	200,000 - 300,000 FCFA · 40-60 %
Medium 4.0 - 6.9	5,000 - 25,000 FCFA · 1-5 %	25,000 - 50,000 FCFA · 5-10 %	50,000 - 75,000 FCFA · 10-15 %	75,000 - 125,000 FCFA · 15-25 %

Physical rewards

On top of the bounty, every accepted contribution earns an item personalised with your handle. Stickers and a named badge for a first accepted finding; an engraved piece for a critical finding, or for the quarterly top 3 on the Hall of Fame.

About your data: we ask for a shipping address at the moment we send the parcel, never at registration, and we delete it once the parcel has gone. It is never stored alongside your reports.

Rules

Engagement rules

In scope

✓Injection (SQLi, XSS, XXE, SSTI...)
✓Authentication and session management
✓Access control and IDOR
✓Sensitive data exposure
✓Malicious file upload
✓SSRF and RCE

Out of scope

✕DoS / DDoS attacks
✕Social engineering
✕Modifying or deleting real data
✕Disclosure before confirmed fix
✕Automated scanning without PoC
✕Clickjacking without demonstrated impact

SLA

Response commitments

24 business hours

Automated acknowledgement upon submission.

5 business days

Initial triage and severity assignment.

30 days

Target remediation for Critical and High findings.

90 days

Target remediation for Medium. Coordinated disclosure possible after this deadline.

Identity must be validated before you submit, and validation takes 24-48 business hours. Do it this week to hunt from the morning of the 5th.

Get my identity validated Rules