Bug Bounty Program
The security of our services and our customers' data is a priority. If you have found a security vulnerability in Rapido Server, please report it responsibly — we pay up to 10,000,000 Toman for confirmed reports.
Maximum reward10,000,000 Toman
Rewards
Each report is rewarded within its severity range, based on the real impact of the vulnerability and the quality of the report.
| Severity | Reward | Examples |
|---|---|---|
| Critical | 6,000,000 – 10,000,000 Toman | Remote code execution (RCE), SQL injection with data access, authentication bypass into an admin account, payment manipulation (free service, wallet theft or double crediting), mass extraction of user data |
| High | 3,000,000 – 5,500,000 Toman | Account takeover of a single user, access to another user's server, invoice or ticket (IDOR), stored XSS in the admin panel, SSRF into the internal network, privilege escalation from staff to admin |
| Medium | 1,000,000 – 2,500,000 Toman | Reflected XSS, CSRF on a sensitive action, bypassing the attempt limit on verification codes or login, leaking semi-sensitive data, breaking discount or referral logic |
| Low | 300,000 – 800,000 Toman | Minor information disclosure, exploitable account enumeration, verbose error messages, a missing security header with real impact |
| Informational | Acknowledgement | Improvements and best practices with no real security impact |
Program rules
Scope
- In scope: the rapidoserver.com website, the user panel and the public API on this domain.
- Out of scope: third-party services (such as the payment gateway and email provider), customers' virtual servers and any domain not listed here.
Eligibility and rewards
- Only the first reporter of a vulnerability is rewarded; duplicates, or issues already known to the team, are not eligible.
- Rewards are paid only after the development team confirms the vulnerability; the development team decides the severity and the final amount within the table range.
- The amounts in the table are maximums, not guarantees; the reward depends on the real impact and the quality of the report (reproduction steps and proof of concept).
- Several reports sharing one root cause count as a single report.
Not eligible
- Denial of service (DoS/DDoS) and heavy automated load
- Social engineering, phishing of staff or customers, and physical attacks
- Bulk SMS or email sending and abuse of forms
- Output of automated scanners without a proof of exploitability
- Missing headers or recommended settings with no real security impact, self-XSS, and issues that only affect outdated browsers
Responsible conduct
- Test only with your own account; do not access, download, modify or delete other users' data.
- Stop testing as soon as the vulnerability is proven and do not extend the access you gained.
- Do not disclose vulnerability details publicly until the issue is fully fixed and the development team says so.
How payment works
- If your security report is confirmed, we will contact you at the email address you submitted the report with, collect your payment details and pay the reward to you.
How to submit
- Send the report as one Markdown file (.md, up to 1 MB) including the affected URL, reproduction steps, security impact and a proof of concept.
- To confirm you own the email address, a 6-digit verification code is sent to it before the report is submitted.
Submit a report
Enter your email to receive a verification code, then send the title and report file.