Vulnerability bug bounty program

If you are a security researcher interested in evaluating ReReady’s security, we welcome your insights. In fact, we offer a bounty on confirmed security issues that have not been previously reported.

Researching vulnerabilities

You must use our sandbox environment for all testing. No approvals are required, and sandbox accounts are free. The sandbox environment will not trigger real payments or shipments, but otherwise this environment is identical to production.

Our sandbox environment allows AI agent testing that is responsible and does not degrade our environment.

Please do NOT research vulnerabilities in our production environment or your account may be suspended.

Reporting a vulnerability

To report a vulnerability, please email support@reready.co to explain:

• Vulnerability name (like “Cross-site scripting (XSS)”)
• Replication instructions, and any other details
• Recommended resolution(s)
• Priority estimate (like “P3”)
• Payment information (see options below)

Please do NOT report multiple vulnerabilities in the same email thread. Please send a separate email for each vulnerability.

We will reply within 5 business days.

Bounty by priority

We rely on the Bugcrowd vulnerability rating taxonomy to rate priority on a scale from P1 (highest) to P5 (lowest). We award the following bounties:

• P1 / Critical: $1,000 USD
• P2 / High: $500 USD
• P3 / Medium: $200 USD
• P4 / Low: $50 USD
• P5 / Informational: Discretionary $25 USD (we issue bounties on actual vulnerabilities, not general information)

Note: Bounties on P4 and P5 were reduced on all reports after 2026-10-11.

Bounty payments

Payments will be issued promptly after we confirm your report is valid and agree on your rating. We can issue payment to any country supported by PayPal. You can choose your payment method:

• PayPal (recommended)
• Zelle (US only)
• Bank transfer (US only, provide your bank account and routing numbers)
• Check by mail (US only, provide your mailing address)

No bounty

We do not offer bounties for certain reports:

• Vulnerabilities previously reported within the past 5 business days. Only the first report will receive the bounty, otherwise the same person could submit the same report under different names, or the same AI tool could produce the same results for different researchers.
• P5 vulnerabilities related to email exposure. All P5 bounties are discretionary, and user emails must be exposed in the course of business (when notifying employees), so low-risk email exposure is not eligible.
• Expected behavior, like ordinary (non-admin) users being able to manage payment methods and addresses, and place orders.