Scope
What you can and cannot do
Each organisation publishes its own scope when launching a programme. The rules below apply by default across the entire platform.
Allowed
- ✓Testing on assets explicitly listed in the programme
- ✓Fuzzing, injection, attack surface analysis within the defined scope
- ✓Non-destructive evidence collection (screenshots, logs)
- ✓Test accounts created with your own email addresses, to test account flows (3 at most)
Prohibited
- ✕Testing outside the scope defined by the organisation
- ✕Denial of service attacks (DoS/DDoS)
- ✕Accessing, modifying, or deleting real data
- ✕Social engineering of employees or customers
- ✕Sharing the vulnerability before it is fixed
Process
How to submit a report
Reproduce
Reproduce the vulnerability reliably before submitting. A non-reproducible report cannot be qualified.
Document
A PDF report is required: description, reproduction steps, screenshots, estimated impact, CVSS reference where applicable. We replay from that document and do not guess what is missing.
Submit
Via the platform submission form. An automated acknowledgement is sent immediately.
Wait
CyberAar validates the report within 5 business days. No public disclosure before the fix is confirmed and all parties agree.
Test traffic
Identification header
Every verified researcher has a personal header to add to all their test requests. It is generated in My account, Security tab (verified identity and two-factor authentication required), in the form:
X-AarMe-Researcher: your_handle:secret_value - What it changes: the SOC recognises your traffic as yours rather than as an attack, and the request ceiling at the platform's edge rises from 60 to 300 per minute. The sign-in, two-factor and form limits stay the same: they are part of the tested scope. Cloudflare's protections still apply.
- How to add it:
curl -H,ffuf -H,nuclei -H,sqlmap --headers, or in Burp a "Match and replace" rule that adds the header to every request. - Invalid value: a wrong, revoked or mistyped value is refused (HTTP 403) and reported to the SOC as an impersonation attempt. Regenerate it from My account if needed.
- Confidentiality: the value is personal and shown only once. Do not share it, and remove it from your screenshots and reports. A value lent to or reused by someone else falls under the programme's sanctions.
Classification
Vulnerability classification
Hall of Fame entry is reserved for findings of critical severity. Severity is assessed using the CVSS scale. Bounties are set by each organisation based on asset criticality, not vulnerability severity alone. Amounts are published when each programme opens.
Critical
9.0 – 10.0
Priority handling
High
7.0 – 8.9
Priority handling
Medium
4.0 – 6.9
Standard handling
SLA
Our commitments
Automated acknowledgement upon submission.
Initial evaluation and severity qualification.
If details are missing, the report moves to "Information requested": it keeps its submission time, and you complete it with a PDF from the tracking page. Without a complement within 14 days, it is rejected for insufficient information.
Coordinated disclosure: you may publish after confirmed fix or 90 days, whichever comes first.
Target remediation timeline, adapted to CVSS score (Critical/High prioritised).
Policy
Report policy
Duplicates
When identical reports are submitted, the first (by timestamp) is retained for the bounty. The second hacker is credited in the Hall of Fame if the finding is critical. No partial reward.
Severity appeal
If you believe your report was under-rated, reply to your decision email with your justification: CVSS v4.0 vector and impact evidence. We will re-evaluate within 5 business days.
CyberAar assessment
Every accepted report is assessed by the team: CVSS v4.0 Base score (technical severity), demonstrated business impact scored from 0 to 10, then final score = √(CVSS × impact). The class of the targeted asset (Standard, Important, Critical, Crown Jewel), set before any report, selects the reward range; the exact final score sets the amount within it. A technically Low vulnerability (CVSS v4 below 4.0) is never rewarded, and a final score below 4.0 is not rewarded: the scale starts at the Medium final severity. The calculation details are given on acceptance.
One verified account per person
One verified identity per person: it is the only account that can submit reports and be rewarded. Test accounts are allowed for testing account flows, using your own addresses, up to 3 per person; they can be neither verified nor rewarded. Beyond 3, or when used for anything other than testing, they are suspended. At most 4 accounts (yours and 3 test accounts) can be created from one network over 30 days; if you share your network with other researchers, write to [email protected].
Two-person review
Every acceptance is approved by at least two members of the CyberAar team, who replay the report before setting the severity and the amount.
Reports by several researchers
Up to 3 co-researchers besides the author, named by their AarMe nickname when submitting. Each confirms their participation from their account before the decision: an invitation not confirmed before the decision gives no entitlement. Every participant must have a verified identity at acceptance and at payment. The reward and the reputation points are shared equally between the author and the confirmed co-researchers; the rounding remainder goes to the author, as does the bonus for the first accepted report on an asset. Each share is paid separately, to each participant, on their own payment details.
Unconfirmed accounts
An address not confirmed within 48 hours gets the account suspended, then deleted 7 days later. A reminder is sent after 24 hours; registering again with the same address starts over.
Report format
A structured report, as a PDF: context, numbered steps with a screenshot at each step, demonstrated impact, a justified CVSS v4.0 vector and score. A list of curl commands with no explanation or screenshot is not a report: it is sent back for completion or rejected. Reports written with the help of AI are accepted when they are coherent, verified and reproducible. The report template is available on our Discord server.
Reply deadline
After acceptance, an email asks for your payment details (Wave, Orange Money or PayPal). You have 30 days to reply; after that, the reward is cancelled.
Individual payment
Each bounty is paid individually upon KYC approval. The amount is defined per programme. No payment pooling.
Identity & payment
KYC verification
Identity verification is required before any report submission. It happens entirely from your account: documents are encrypted the moment they arrive, reviewed by the CyberAar team (24 to 48 business hours), then destroyed as soon as a decision is recorded. We keep no copy and never accept them by email.
Creating your account
- ✓Account created with a password and two-factor authentication
- ✓Documents uploaded from your account, encrypted on arrival
- ✓Verification within 24-48 business hours
- ✓Documents destroyed on decision, only an attestation is kept
After account activation
- →Report submission unlocked
- →National ID card or passport accepted, any country
- →Wave or Orange Money (UEMOA zone), PayPal everywhere else
- →Payment account in your name, the one on your ID: no payment to a third party
- →Payment within 15 business days of receiving your payment details
What we keep, and for how long. Your four identity documents are destroyed as soon as the decision, approval or rejection, is recorded; without a decision, they are destroyed at the latest 7 days after upload. We keep no copy. So that one person cannot verify two accounts, the team reads your name, date and place of birth, issuing country and document number from the document: these data are not recorded, only two keyed fingerprints (HMAC-SHA256 with a secret key) are kept. They let us recognise the same document or the same person on another account, without allowing the original data to be recovered. Only a verification attestation remains: the decision, its date, the team member who made it, the list of document types reviewed and their SHA-256 fingerprint (a string that proves which files were reviewed, without allowing them to be rebuilt) and, where relevant, a team note on the decision. An approved verification is valid for 2 years; after that you upload new documents. The attestation is kept for as long as your account exists. This processing falls under law n° 2008-12 on personal data protection. No document is ever shared with partner organisations.
Private programme
Invite-only access
A private programme is visible and accessible only to hackers explicitly invited by CyberAar on behalf of the organisation. The programme name, assets and scope are not publicly visible.
Invitation required
Only hackers selected and approved by CyberAar receive access. Any testing attempt without an invitation is out of scope.
Dedicated VPN access
Programme assets are delivered over a dedicated VPN tunnel provided by CyberAar. No private asset is exposed on the public internet.
Full confidentiality
Invited hackers are bound by a confidentiality agreement. No disclosure of the scope, assets or discovered vulnerabilities is permitted without explicit consent from the organisation.
Legal safe harbour
Hackers acting in good faith, in compliance with these rules and the scope defined by the organisation, will not face any legal action from CyberAar. We commit to working with our partner organisations to extend this protection to valid reports submitted through the platform. Safe harbour does not cover deliberate access or actions outside the defined scope.
Create your account and get your identity verified. Report submission opens after that.
Changelog
- 2026-10-22 Reward threshold written in the Rules: a CyberAar final score below 4.0 is not rewarded (the scale starts at the Medium final severity, as the programme page already showed). A sign-in lock now states how long it still runs (Retry-After header).
- 2026-10-12 X-AarMe-Researcher identification header: add it to test requests, checked at the platform edge, ceiling of 300 requests per minute instead of 60. Sessions: list of open sessions and sign-out of the others from My account; a session ends 24 hours after sign-in.
- 2026-10-08 Payment: the account receiving the reward must be in the researcher's verified name, the one on their ID; the team checks it before every payment and never pays a third party.
- 2026-10-08 Reports by several researchers: the reward and the points are shared equally between the author and the co-researchers confirmed before the decision, each share paid separately to a participant with a verified identity.
- 2026-10-08 Test accounts: at most 4 accounts (yours and 3 test accounts) created from one network over 30 days, IPv4 address or IPv6 /64 block. Shared network: write to [email protected].
- 2026-10-07 One verified identity per person, checked against the document: at approval, two keyed fingerprints are computed from the name, date and place of birth and document number, then compared with existing accounts. The data themselves are not kept. The account name must be the one on the ID.
- 2026-10-07 KYC data retention clarified: the "retained for 5 years" statement was wrong. Identity documents are destroyed on decision; only a verification attestation is kept.
- 2026-10-06 CyberAar assessment: CVSS v4.0 (instead of 3.1), demonstrated business impact, final score = √(CVSS × impact), asset classes Standard, Important, Critical and Crown Jewel. Scale as a percentage of a 500,000 FCFA Bounty Max; a technically Low vulnerability is never rewarded. Applies to reports decided from 6 October 2026.
- 2026-10-06 Two-person review: every acceptance is approved by at least two team members. Unconfirmed accounts: reminder after 24 hours, suspension after 48 hours, deletion 7 days later. Two-factor authentication is required to submit a report.
- 2026-10-05 Test accounts limited to 3 per person, on top of the verified account. Report format specified: structured report with a screenshot per step, curl commands alone refused, AI-assisted writing accepted when the report is coherent and reproducible. Report template and community on Discord: https://discord.gg/7CsEjRqnFw
- 2026-10-05 A rejection or duplicate decision can be reconsidered by the team, always in the researcher's favour: the report goes back to qualification and the researcher is told by email, with the reason.
- 2026-10-05 Amount within the range set on demonstrated impact (data exposed or modified, accounts affected, exploitation conditions), with the CVSS score as an indicator: replaces the proportional calculation, which flattened differences in impact. Amount and justification given on acceptance.
- 2026-10-05 Amount calculated proportionally within the range from the CVSS score retained by the team, rounded to the nearest 1,000 FCFA: replaces the lower-half / upper-half rule published the same day. The range grid applies to reports decided from 5 October 2026, no longer only to reports submitted from 6 October; no report had been accepted before.
- 2026-10-05 PDF report required at submission. New "Information requested" status: the report keeps its submission time and is completed with a PDF within 14 days, otherwise it is rejected for insufficient information.
- 2026-10-05 Reward grid in ranges (low end for the lower half of the CVSS band, high end for the upper half), from 20,000 to 500,000 FCFA, for reports submitted from 6 October 2026.
- 2026-10-05 One verified account per person; test accounts framed (your own addresses, neither verifiable nor rewarded). Second factor enrolment limited to confirmed addresses.
- 2026-10-05 Report decisions: an email at every step (qualification, acceptance, rejection with a reason, duplicate, retest, payment). 30-day deadline to send your payment details after acceptance. Report tracking limited to signed-in accounts.
- 2026-10-04 CyberAar programme opened. Public amounts restored (30,000 to 500,000 FCFA by severity and asset criticality). Personalised physical rewards added: shipping address requested only at dispatch, then deleted.
- 2026-07-25 Added PayPal as payment method (Wave, Orange Money, PayPal). Private programme section (invitation, dedicated VPN, confidentiality).
- 2026-07-24 Removed public bounty amounts: rewards defined per programme based on asset criticality.
- 2026-07-24 Report policy section: duplicates, severity appeals, individual payment.
- 2026-07-24 Per-asset bounty table. Remediation deadline 30 → 90 days.
- 2026-07-24 Coordinated disclosure policy (90 days) made explicit.
- 2026-07-23 Public launch - programme open to hackers and organisations.