Researchers

Who tests your systems

The right first question about any bug bounty. Here is the whole answer: who may be invited, how they are checked, what binds them, and what the platform refuses to let them do.

Chosen for your engagement, not drawn from a crowd

Testing is invitation-only. For each engagement we invite researchers whose skills fit what you want tested: your web app, your API, your mobile app. Nobody can find your programme and sign up to it. We select and verify the researchers for your scope before the start date you agree with us.

Checked by a person before any invitation

• Identity: a government-issued document, checked by a person on our team, before a researcher can be invited to anything.
• Jurisdiction: no reward is paid to a researcher in a comprehensively embargoed jurisdiction; the platform refuses that payout.
• Account standing: only an active, verified account can reach an engagement. A suspended or closed account stops working immediately.

Bound in writing, per engagement

• Each researcher signs a non-disclosure agreement for your engagement.
• Nothing is touched until three things exist at once: your named scope, the signed NDA, and your written testing authorisation. Each blocks on its own, and there is no override in the interface.

Re-checked on every request

Every time a researcher works on your engagement, the platform checks again that they are active and verified, that they accepted the invitation, that their NDA is signed, that the engagement is live, and that today falls inside the dates you set. Outside those dates it refuses access to the engagement and refuses any finding. A finding against an asset recorded as out of scope is refused.

What each side sees

• Researchers are never given your company's name, officers or contacts. Your scope itself may identify you.
• You never learn a researcher's legal identity.
• Our team validates and scores every finding before it reaches you, with the steps to reproduce it.
• Nothing about your systems is published without your approval of the exact wording.

What we do not claim

The platform controls who may test, when, and what they may submit. It does not sit in your network path, so it does not filter traffic to your systems: that is why the scope, the dates and the written authorisation matter, and why access closes when the window does. The full list of what is and is not claimed is on our security page; the mechanism is on how it works.

Want to know who would test your stack before you commit? Write to founder@exceptionsecurity.com. Costs are on the pricing page.