At Rain, we recognize the value that security researchers provide to our community, and as such, we encourage the responsible disclosure of any legitimate vulnerabilities. Fair compensation will be provided for qualifying discoveries and we request researchers to report any findings through email to [email protected].
What is a qualifying discovery?
A qualifying discovery should directly involve a security vulnerability relating to, but not limited to, the following: website, mobile applications, and other technological infrastructures. Rain will ultimately decide if a discovery is qualifying or not.
Some examples of discoveries that would not be eligible include:
Findings related to third parties that do not relate to security of the Rain platform (e.g. support.rain.com, the live chat app, etc…)
Informational bugs that do not have any impact on the security posture of Rain.
DDoS related attacks.
Issues that have previously been discovered by other researchers.
Failing to provide instructions to reproduce.
Abusing the discovery to negatively impact Rain, or its customers, in any way.
When you submit a report, make sure to include to include the following:
Steps and instructions to reproduce.
Proof of concept.
Recommendations.
Your BTC address for compensation.
Rain will review your submission and you will receive a response in at least 30 business days.