Tiquo Bug Bounty Program
Found a security issue in Tiquo? We welcome responsible disclosure from security researchers. Read the scope and rules below before testing or submitting a report.
How It Works
You discover a potential security vulnerability in a Tiquo product.
You submit a detailed report to our security team.
We review your report internally within 24 hours. Our formal response to you may follow later.
Our team investigates, reproduces, and classifies the severity of the issue.
We notify you of our classification and the reward amount.
Payment is issued within 30 days of classification.
All severity classifications and reward amounts are determined by Tiquo after submission. We assess every report individually based on the real-world impact, exploitability, and scope of the vulnerability.
We receive hundreds of false reports generated by AI. We reserve the right to reject or leave unanswered reports that provide no useful information about a real issue.
Bug bounty testing on any production Tiquo account requires prior written approval from Tiquo. If you engage in any activity targeting these accounts without that approval, no reward will be paid, regardless of your findings.
What's in Scope
Our bug bounty program covers the following:
- tiquo.co
- Tiquo API endpoints
- Tiquo iOS and Android mobile applications
- tiquo.app webapp / dashboard
- Authentication and authorization flows
- Payment and data handling processes
- Tiquo hardware
What's Out of Scope
The following are not eligible for rewards:
- Third-party services or integrations not owned by Tiquo
- Social engineering or phishing attacks against Tiquo employees or customers
- Denial of service (DoS/DDoS) attacks
- Spam or rate-limiting issues with no direct security impact
- Isolated projects which have no sensitive data or customer information
- Vulnerabilities requiring outdated browsers or platforms
- Issues that have already been reported or are already known to us
- AI-generated, automated, or speculative reports not based on a manually verified, working proof of concept.
- Missing security headers, harmless error messages or internal details, clickjacking on non-sensitive pages, version disclosures, outdated software without a working exploit, and theoretical XSS or CORS findings without demonstrated security impact.
Reward Tiers
Only reproducible vulnerabilities with demonstrated security impact qualify for rewards. Severity depends on proven impact and exploitability, not the vulnerability name or scanner rating. Reports with no meaningful impact are not eligible for payment.
Proven compromise of core production systems with widespread impact.
Proven working exploit with substantial security impact.
Exploitable issues with meaningful but limited impact. Higher rewards require proven High or Critical impact.
Minor, reproducible vulnerabilities with small but demonstrable security impact.
Bonus Awards
Tiquo reserves the right to award bonuses above the stated ranges for exceptional reports. Factors that may qualify a submission for a bonus include particularly well-written reports with clear reproduction steps, vulnerabilities with widespread impact across multiple systems, creative exploitation chains that reveal deeper architectural issues, or researchers who work closely with our team during remediation. Bonus amounts are determined on a case-by-case basis.
Submission Guidelines
To help us investigate quickly, please include the following in your report:
- 1A clear description of the vulnerability
- 2Step-by-step reproduction instructions
- 3The affected URL, endpoint, or application screen
- 4Your testing environment (browser, OS, device)
- 5Screenshots or proof-of-concept code where possible
- 6Your assessment of the potential impact
Please submit one vulnerability per report. If you've found multiple issues, send a separate report for each.
Rules of Engagement
- 1Do not access, modify, or delete data belonging to other users.
- 2Do not run automated scanning tools against production systems without prior written approval from Tiquo.
- 3Do not publicly disclose any vulnerability, report, proof of concept, or related details at any time.
- 4Do not use AI tools or large language models to generate or write your reports. We want original research based on your own hands-on testing. Submissions that appear to be AI-generated, speculative, or not based on a genuine, manually verified vulnerability will be rejected without review and may result in removal from the program.
- 5Act in good faith at all times.
Safe Harbour
Security researchers who act in good faith and follow the rules above will not face legal action from Tiquo. We consider responsible security research conducted in line with this policy to be authorised activity. We will not pursue civil or criminal action against researchers who comply with this program. This program is offered at Tiquo's discretion. We reserve the right to determine eligibility, severity, and reward for any submission, and to amend, suspend, or end the program at any time. All decisions made by Tiquo are final, and participation does not create any contractual entitlement to a reward.
Contact
Submit your reports to:
security@tiquo.coWe review every report internally within 24 hours of submission. Our formal response may take longer, depending on the issue's complexity and the time needed to reproduce and assess it. Please don't send messages asking for a status update, as these slow down reviews. We'll contact you as soon as we have an update. You can expect an initial assessment within 10 business days.