Vulnerability report

Submit a vulnerability

Fill in this form for each vulnerability found within the authorised scope. Response within 5 business days. Read the programme rules before submitting.

Identity

Vulnerability

Evidence

Report template. Write your PDF from our template: context, steps with a screenshot each, impact, CVSS. It is available on the AarMe community Discord server.

Download on Discord

Tips for a strong report

What helps

›Precise title (type + location)
›PDF report with screenshots
›Step-by-step reproducible steps
›Concrete impact described
›CVSS self-assessment with justification

What gets rejected

›curl commands alone, without explanation or screenshots
›Version disclosure without impact
›DoS or denial-of-service attacks
›Physical access required
›Theoretical vulnerability without proof

Common mistakes

›Submitting the same bug multiple times
›Non-reproducible steps
›Overstated severity without justification

01 · Identity

Name or alias *

Email *

URL or endpoint concerned *

Programme and asset * The asset your report concerns: it sets the programme and the asset class used for the reward.

02 · Vulnerability

Category *

Estimated severity *

Title *

Description *

Steps to reproduce *

Impact (optional)

03 · Evidence

PoC URL / Description (optional)

PDF report * (required, max 5 MB: reproduction steps and screenshots) Drag a file here or click to browse PDF · max 5 MB

Co-researchers (optional)

If you found this together, name each person's AarMe nickname (3 at most). Each confirms their participation from their own account before the decision. The reward and the points are shared equally, each share paid separately. Every co-researcher needs a verified identity.

By submitting this report, you confirm you have acted within the programme rules and our responsible disclosure policy.

An error occurred. Please try again or email [email protected].