The Official Bug Bounty Program
We collaborate actively with security researchers, white-hat ethical hackers, and student developers to safeguard student records and harden our infrastructure.
Bounty Tiers & Compensation
Rewards are determined based on CVSS v3.1 severity impact and quality of report reproduction.
Critical Severity
Remote Code Execution (RCE), SQL Injection with credential exfiltration, SSO session forgery, cross-tenant database bypass.
High Severity
Stored Cross-Site Scripting (XSS) impacting authenticated sessions, broken object-level authorization (BOLA) in wallet or grades.
Medium Severity
CSRF on state-changing endpoints without re-authentication, rate-limit evasion on OTP verification, sensitive data disclosure.
Low Severity
Subdomain takeover vulnerabilities without proof-of-concept, missing security headers with demonstrable security impact.
How to Submit a Vulnerability Report
Send your encrypted proof-of-concept (PoC) to our security team. Include clear reproduction steps, HTTP request/response payloads, and potential impact assessment.