Vulnerability bounty programme
Last updated: 8 July 2025
AKAERE NETWORKS TECHNOLOGY LTD runs a coordinated vulnerability disclosure programme for akae.re and related network services. We pay bounties for valid, in-scope findings that we can reproduce.
1. How to report
Email security@akae.re with:
- A short summary and impact
- Affected URL, host, or service
- Step-by-step reproduction (no exploit payload dumps unless required)
- Your preferred contact and payment details if a bounty may apply
We aim to acknowledge within 3 working days and give a severity decision within 10 working days of a complete report.
2. Safe harbour
If you act in good faith, stay in scope, avoid privacy harm, and report to us first, we will not pursue legal action for that research. We may still restrict accounts that violate these rules.
3. In scope
akae.reandwww.akae.re(authentication, OAuth/OIDC, account, partner, ASN, KYC)- Public APIs on those hosts that do not require a partner-issued token you do not own
- Customer-facing BGP, BGP tunnel, and IXP control-plane interfaces we operate
4. Out of scope
- Denial of service, flooding, or resource exhaustion
- Social engineering, phishing, or physical access
- Reports from automated scanners with no demonstrated impact
- Clickjacking on pages with no sensitive action
- Missing security headers without a working exploit path
- Self-XSS, logout CSRF, or issues requiring an already-compromised session
- Third-party services (Stripe, Cloudflare, PeeringDB, Telegram, Resend) except our integration of them
- Customer networks, tunnels, or ASN objects we do not operate
5. Rewards
Rewards are at our discretion, paid in GBP or equivalent, and may be reduced for duplicates, limited impact, or incomplete reports. Typical ranges:
| Severity | Examples | Typical reward |
|---|---|---|
| Critical | Unauthenticated RCE, auth bypass across accounts, mass PII or KYC document exposure | £1,000 – £5,000 |
| High | Privilege escalation to admin or partner, stored XSS on authenticated high-value pages | £400 – £1,000 |
| Medium | IDOR limited to a single record, CSRF on sensitive state-changing actions | £100 – £400 |
| Low | Information leaks with clear security impact, weak session handling with a practical attack | £50 – £100 |
Informational findings may be accepted with thanks and no payment.
6. Disclosure
Do not publish details until we have mitigated the issue, or 90 days after we acknowledge the report, whichever is sooner, unless we agree otherwise in writing. We may request a longer window for complex network changes.
7. Eligibility
- You must be 18 or over, or have a parent or guardian receive payment
- You must not be a current Akaere employee, contractor, or immediate family of one
- Sanctions and anti-fraud checks may apply before payment
- One bounty per unique issue; first complete report wins
Questions about this programme: security@akae.re. Legal questions: legal@akae.re.