The rules of the hunt.

BugHunt connects organizations running vulnerability disclosure (VDP) and bug bounty (BBP) programs with independent security researchers (“hackers”). BeeraSafe operates the platform, verifies identities, holds bounty pools, triages where engaged to do so, and moves money. Researchers are independent third parties — never employees, contractors, or agents of BeeraSafe or of any organization.

Test only published, in-scope targets. Anything outside a program's scope table is out of contract — even if it looks related.

Prove, don't exploit: no persistence, no data exfiltration beyond what proves impact, no degradation of services, no public demonstration of a live target.

Register on targets with an account containing your BugHunt handle where the program requires it, and declare that identity on every submission.

Keep unpublished findings private until the report is RESOLVED. Valid reports follow the program's disclosure rules thereafter.

One account per human. Sharing accounts, automating submissions, or hammering infrastructure with scanners is grounds for removal.

Anyone may hunt, but money needs trust. Payouts require a verified hacker identity: legal name, country, government ID reference, and a face-verification reference, reviewed by platform admins. Organizations verify with a corporate mailbox (business domains only — freemail and temporary mail are rejected), registration particulars, and an accountable contact.

Unverified hackers cannot enter private programs, cannot be paid, and cannot appeal. Verification details are text-only and visible only to reviewers; payout numbers are masked everywhere except inside a payout call.

Bug bounty (BBP) programs run on pre-funded pools: the organization funds its pool in full, in UGX, before awards can lock. Disclosure (VDP) programs hold no money by definition.

When a report is confirmed and the fix verified, staff propose an award in whole UGX. BeeraSafe keeps a 30% platform fee on every award; the hacker nets 70%. A 1,200,000 UGX award is therefore a 360,000 UGX fee and an 840,000 UGX payout, split across contributors by their agreed shares. Fee, net, and splits are shown on the report before anything moves.

Payouts release only on RESOLVED or CLOSED reports with a PASS fix-verification (or an explicit staff waiver), to verified hackers with complete payout details, via mobile money or bank transfer at the hacker's choice. Reports closed as WONTFIX release their locked funds back to the pool automatically.

Organizations authorize BeeraSafe to hold pool funds and to forward net bounties to hackers on-valid-resolution. Pool balances and every movement are ledgered and visible to program staff at all times.

Reports move through SUBMITTED, TRIAGED, AWAITING_INPUT, RESOLVED, WONTFIX, CLOSED, every move recorded with who did it and why. Response deadlines are published per program; breached deadlines let the reporter escalate with one click.

Disagree with a closed call? Appeal once with evidence. Platform admins mediate — program staff never judge their own case — and an upheld appeal reopens the report.

Public disclosure needs both sides: the reporter offers, the program approves. Private programs never publish. Published findings show the technical details with award amounts and internal notes withheld.

Organizations warrant they own (or are authorized to test) every in-scope asset, will keep scope accurate, will triage within their published deadlines (or engage platform managed triage, a billed service), and will keep their pool funded for the awards they approve.

BeeraSafe may pause intake on programs that go unattended, and may remove programs whose rules facilitate abuse. Pool funds of a removed program return to the organization minus released awards and fees.

Testing out of scope, extorting organizations, disclosing unpublished findings, falsifying verification, sharing accounts, or attacking the platform itself ends in suspension and forfeiture of pending payouts. BeeraSafe cooperates with law enforcement on criminal conduct. Appeals against enforcement go through the disputes process.

BugHunt is provided as-is. BeeraSafe does not guarantee vulnerabilities will be found, bounties will be earned, or the platform will be uninterrupted. To the maximum extent permitted by law, liability is limited to amounts paid or payable in connection with the specific award or pool at issue. These terms are governed by the laws of Uganda. Questions: contact us.