Pending Reports and Approved Awards

• Submitted before the pause: Reports already received will continue through triage, remediation, and verification, prioritized by user-data risk and available capacity. Eligibility and any reward will be assessed under the terms in effect when each report was first submitted; the pause and revised reward ranges below do not apply retroactively.
• Pending decisions: A submission, acknowledgment, validation, or fix does not itself guarantee an award. We will communicate validation and reward decisions directly to the reporter. Follow-up evidence for an existing report remains part of that report; please reply to the existing email thread.
• Approved awards: All awards already approved in writing will be honored at the approved amount and under the agreed payment terms. The pause does not cancel or reduce those commitments.
• New submissions during the pause: Responsible disclosure remains open, but new reports are not eligible for monetary rewards, including retroactive rewards after any reopening.

Reward Reference — Paid Program Paused

The revised ranges below are retained for reference only. They are not an active offer, do not replace the terms for earlier reports, and do not promise future awards. Any reopening will state its applicable terms and effective date.

Important: All reward amounts are at UnoLock's sole discretion based on severity, impact, quality of report, and current budget availability. The ranges are guidance for approved awards, not a minimum payment or a promise of payment. The revised reference cap is $500 AUD per unique root cause; earlier reports retain their submission-time terms.

Platforms In Scope

• UnoLock Web App (PWA): https://safe.unolock.com
• Windows Store App: Desktop application
• API Endpoints: UnoLock-controlled APIs used by the in-scope applications

Out of Scope Platforms

• The UnoLock Agent, currently in alpha, is outside the bug bounty program’s scope.
• https://app.unolock.com is excluded from this program; testing on that host is not authorized by this policy and findings on it are not eligible for rewards.
• Third-party services themselves (AWS, Stripe, Google Workspace); qualifying flaws in UnoLock-controlled integrations remain eligible
• Mobile apps (not yet launched)
• Browser extensions (don't exist)

Reward Eligibility: Demonstrated User-Data Risk

These revised criteria are retained for reference while paid bounties are paused. They do not make new submissions eligible for payment or replace the terms applicable to pending reports:

• Identify a reproducible vulnerability affecting the current publicly released production version of an in-scope UnoLock application or the UnoLock-controlled APIs it uses. Development, staging, unreleased code, unsupported versions, and custom builds alone do not qualify.
• Provide a complete, repeatable proof of concept that UnoLock can independently reproduce, from attacker-controlled input to unauthorized user-data impact. State every prerequisite, required privilege, and user interaction, and show evidence for each step of the exploit chain. Source-code observations, scanner output, severity scores, and hypothetical impact alone do not qualify.
• Demonstrate material unauthorized access to or disclosure of protected user data, exposure of encryption keys or recovery secrets, unauthorized modification or deletion of user data, or an exploitable loss of legitimate data recovery. Use synthetic data to show the actual result; an error message, attempted operation, or missing defensive check alone is insufficient.
• Be assessed by UnoLock as High or Critical based on demonstrated user impact, exploitability, and affected scope.
• Be the first complete, reproducible report of a unique root cause that has not already been reported, publicly documented, or identified in a documented internal finding. Comply with the testing and coordinated disclosure rules. Incomplete reports do not reserve priority for a later submission.

A controlled local reproduction is acceptable for attacks that cannot safely be tested in production, including malicious-server scenarios, provided it uses the unmodified current release client and faithfully reproduces the relevant production protocol and configuration. Identify all simulated attacker capabilities and demonstrate a boundary crossing beyond those capabilities. Do not compromise production infrastructure to obtain simulated capabilities or target other users.

Use only your own test Safes and synthetic data, including separate attacker and victim test Safes where needed. You do not need to compromise a real user to demonstrate impact. Do not access other users' data or perform destructive production testing.

Business-logic, payment, subscription, quota, or licensing flaws qualify only if a demonstrated exploit chain independently meets the High/Critical user-data impact requirements. Lost revenue, unpaid feature access, or increased operating costs alone do not qualify.

Sensitive metadata disclosure can qualify when it demonstrates a material privacy breach, such as linking an identity to a private Safe or exposing confidential relationships. Public identifiers, endpoint discovery, or generic technical metadata alone do not qualify.

Tier 1: Critical Security Issues (Reference: $250 - $500 AUD; Paused)

Examples include practical compromise of Safe contents or keys with few prerequisites, or widespread unauthorized destruction of protected user data:

• Authentication or authorization bypass that gives an attacker access to another user's Safe contents or secrets.
• A cryptographic or key-management flaw that exposes plaintext, encryption keys, recovery secrets, or stored cryptocurrency private keys.
• A cross-Safe isolation failure enabling broad unauthorized reading, modification, or deletion of user data.

Examples are illustrative; the demonstrated attack and impact determine severity and eligibility.

Tier 2: High Security Issues (Reference: $100 - $250 AUD; Paused)

Examples include material compromise of protected user data with narrower scope or additional attack prerequisites:

• XSS, session hijacking, or CSRF that demonstrably enables unauthorized reading, modification, or deletion of Safe data or changes to data-access permissions.
• Authorization or encryption failures exposing files, Vault Messaging content, UnoLock Drop transfers, or private shared-Space data.
• LegacyLink, recovery, or access-control flaws that grant unauthorized access or let an attacker irreversibly prevent legitimate recovery of protected data.
• Client-side flaws exposing protected plaintext or secrets after a Safe closes, or leaking them to an unauthorized party while it is open.

Observing your own decrypted data in an unlocked Safe or changing your own browser state does not establish an unauthorized-access vulnerability. Show how an attacker can cross the relevant security boundary.

Tier 3: Medium Issues (No Monetary Reward)

Validated issues below the High/Critical user-data impact threshold may be investigated and fixed, but are not eligible for payment.

Tier 4: Low/Informational Issues (No Monetary Reward)

Minor security observations, best-practice recommendations, and product defects are welcome as feedback, but are not eligible for payment.

Not Eligible for Monetary Rewards

Reward exclusions do not prevent responsible reporting or remove safe-harbor protection for testing that complies with the applicable rules. Prohibited testing remains prohibited.

Business and Low-Impact Issues

• Payment or subscription bypass, unpaid premium features, tier or license bypass, coupon abuse, storage/quota overages, and other revenue-only or operating-cost issues without qualifying user-data impact.
• UI/UX defects, broken buttons, rendering failures, compatibility issues, and ordinary reliability bugs without an exploitable security boundary failure.
• Missing headers, CSP or SRI recommendations, version banners, verbose errors, exposed endpoint names, and automated scanner or dependency alerts without a demonstrated qualifying exploit.
• Rate-limit observations, theoretical attacks, self-XSS, and clickjacking without demonstrated High/Critical user-data impact.

Infrastructure

• Vulnerabilities in AWS services themselves; UnoLock-controlled configuration or integration flaws remain eligible if they meet the user-data impact requirements
• Stripe payment processor vulnerabilities
• Google Workspace vulnerabilities
• Third-party CDN or hosting issues

Attack Types

• Denial of Service (DoS/DDoS) attacks
• Social engineering (phishing, pretexting)
• Physical attacks (device theft, shoulder surfing)
• Attacks that require prior control of the victim's device, browser, or client code, or possession of secrets that already grant the claimed access, without demonstrating an additional independent UnoLock security-boundary failure
• Timing or side-channel attacks (cache timing, electromagnetic analysis, etc.)
• Brute force attacks without demonstrating rate limiting bypass
• Self-XSS (user pasting malicious code into their own vault)

Non-Security Issues

• Typos or grammatical errors
• Feature requests
• UI/UX improvements without security impact
• Browser compatibility issues

Previously Disclosed Issues

• Vulnerabilities already reported by another researcher
• Issues publicly disclosed before private reporting
• Duplicate reports, variants of an already reported root cause, and issues already identified in a documented internal finding

How to Submit a Vulnerability

1. Email: security@unolock.com

2. Use PGP Encryption (Recommended): Download our PGP public key

Required for Reward Consideration:

• Vulnerability Description: Clear explanation of the security issue
• Impact Assessment: The protected data at risk, security boundary crossed, realistic attack prerequisites, and demonstrated result using your own test data
• Reproduction Steps: Complete setup and step-by-step instructions, including separate attacker and victim test roles where relevant, expected behavior, and the observed unauthorized result
• Proof of Concept: A minimal working exploit or complete manual reproduction, with sanitized requests, responses, or other evidence showing the result. Screenshots or video alone are insufficient if the attack cannot be independently reproduced
• Affected Components: URL, API endpoint, or feature affected; exact application version or build, browser/OS where relevant, test date, and any local simulation or configuration differences
• Suggested Fix: (Optional) How to remediate the vulnerability

Response Timeline

Rules of Engagement

You May:

• Create test accounts/vaults for research purposes
• Test on your own data only
• Use automated tools with rate limiting respect
• Test all in-scope platforms and features
• Report vulnerabilities confidentially

You Must Not:

• Access, modify, or delete other users' vaults or data
• Perform denial of service attacks
• Spam or abuse the platform
• Social engineer UnoLock employees or users
• Publicly disclose vulnerabilities before fix deployment
• Violate any laws or regulations

Safe Harbor

UnoLock commits to the following safe harbor for security researchers who:

• Follow the rules of engagement outlined above
• Report vulnerabilities responsibly to security@unolock.com
• Give us reasonable time to fix before public disclosure
• Do not exploit vulnerabilities beyond proof of concept
• Do not access, modify, or delete other users' data

We will not pursue legal action against researchers who comply with these terms. We consider good-faith security research conducted under this program to be authorized testing.

Payment Methods

If a monetary reward is approved in writing, payment can be arranged after validation and fix deployment via:

• Wire Transfer: Available for approved monetary rewards

Tax Responsibility: Researchers are responsible for any tax obligations in their jurisdiction.

Important Terms

Discretionary Rewards

All reward amounts are at UnoLock's sole discretion based on:

• Severity of impact
• Quality of report and reproduction steps
• Whether issue is in scope
• Whether issue is a duplicate
• Current budget availability

First Come, First Served

Only the first complete, reproducible report of an eligible unique root cause is considered. Variants of the same root cause across endpoints, platforms, affected Safes, or exploit techniques are treated as one finding, with one aggregate reward subject to the cap applicable when the report was first submitted. Splitting a report does not create additional reward eligibility. Additional affected endpoints or exploit variants do not earn separate payments when they arise from the same root cause.

Budget and Review Capacity

UnoLock may temporarily pause paid-bounty intake when budget or review capacity is limited. The current pause allows time to fix and verify existing reports. We plan to review it on January 16, 2027; the review does not automatically restart rewards. Any resumption will be explicitly announced on this page. Responsible disclosure remains open, and awards already approved in writing will be honored.

Reward Ranges

Reward amounts listed are ranges, not guaranteed payments. Eligibility and any award are determined after validation and impact assessment, subject to available budget. Submission, acknowledgment, validation, or remediation alone does not guarantee payment; an award requires written confirmation from UnoLock.

Program Changes

Temporary pauses on paid-bounty intake take effect when announced on this page and do not change the terms for reports already received or awards already approved. Other program modifications or termination will be announced with 7 days notice. Revised reward terms apply to reports first submitted on or after the announced effective date; earlier reports are assessed under the terms in effect when first submitted. Awards already approved in writing will be honored.

Questions About This Program?

Security Team: security@unolock.com

PGP Public Key: unolock.com/.well-known/pgp-key.txt

General Support: support@unolock.com