Security & Bug Bounty Reporting

Program information

Program status

Active

Program last updated

July 2025

Eligible severity

High and Critical

In-scope asset

https://app.bananote.ai

1. Scope

The only asset included in this program is:

https://app.bananote.ai

The program applies exclusively to the Bananote application at this exact hostname.

The following are explicitly out of scope:

• https://bananote.ai, Bananote's public marketing website.
• Any other subdomain of bananote.ai.
• Third-party services, APIs, infrastructure, or applications, including services integrated with or linked from Bananote.
• Infrastructure, services, and systems not explicitly identified as in scope above.

Including app.bananote.ai does not extend the scope to other domains, subdomains, IP addresses, infrastructure, or services associated with Bananote. Reports concerning out-of-scope assets will not be considered.

2. Testing restrictions

Bananote does not authorize penetration testing or active security testing under this program.

This is a limited-scope vulnerability reporting and paid reward program. Participation does not grant permission to deliberately attack, probe, compromise, or attempt to gain unauthorized access to Bananote systems.

The following activities are expressly prohibited:

• Penetration testing or active security assessments.
• Automated vulnerability scanning, fuzzing, crawling, or security testing tools.
• Brute-force attacks, credential stuffing, or password guessing.
• Attempts to bypass authentication, authorization, access controls, or subscription entitlements.
• Exploitation of suspected vulnerabilities to obtain unauthorized access to systems, accounts, or information.
• Attempts to access, modify, delete, or extract another user's information.
• Denial-of-service testing, resource exhaustion, or activity that could disrupt service availability.
• Social engineering, phishing, impersonation, or attempts to manipulate Bananote employees or users.
• Physical attempts to access Bananote facilities, devices, or infrastructure.
• Modifying, deleting, or otherwise changing data, configurations, or system state in Bananote's application or services.
• Accessing, collecting, or retaining more information than is strictly necessary to document an observed issue.
• Threatening disclosure, withholding vulnerability details, or demanding payment in exchange for keeping a vulnerability confidential or disclosing it.
• Testing third-party services, infrastructure, or integrations.

Reports must be based on vulnerabilities identified through ordinary use of the application, observations, or other information obtained without unauthorized testing. Researchers must not attempt to escalate access, bypass security controls, or investigate beyond their existing authorization.

If another user's information or sensitive data is unexpectedly encountered, all activity must stop immediately. The information must not be accessed further, retained, copied, shared, or investigated.

Providing evidence for a report does not authorize prohibited testing or exploitation.

3. Paid bug bounty eligibility

Bananote provides monetary rewards for qualifying, previously unreported security vulnerabilities that are verified by our team.

Only vulnerabilities classified as High or Critical severity are eligible for a monetary reward and consideration under this program.

Severity is assessed based on the vulnerability's actual or reasonably substantiated security impact, exploitability, scope of exposure, and potential consequences for Bananote and its users.

• Critical: Vulnerabilities with exceptionally severe consequences, such as widespread compromise of application security, significant exposure of sensitive information, or loss of control over critical systems.
• High: Vulnerabilities with substantial security consequences, such as significant unauthorized access to protected functionality, sensitive information, or user accounts.

These descriptions are indicative, not exhaustive. Bananote determines the final severity classification and reward eligibility for each submission.

Rewards are determined on an individual basis. A severity classification does not guarantee reward. Reports classified as Medium, Low, Informational or Duplicate are not eligible for rewards.

4. Mandatory report requirements

All reports must be submitted through the official vulnerability submission form:

Submit a Bananote security vulnerability report

Reports submitted through other channels will not be considered.

Every submission must include all of the following:

1. A qualifying vulnerability: A suspected High or Critical severity security vulnerability affecting app.bananote.ai.
2. Exact reproduction steps: A clear, numbered sequence describing precisely how the observed vulnerability occurs.
3. Video evidence: A recording documenting the observed behavior and its security implications, without additional testing or exploitation.
4. Technical explanation: The affected functionality, the security weakness, and the potential impact on Bananote or its users.
5. Supporting details: Relevant screenshots, technical observations, or request and response excerpts where applicable.

Incomplete submissions, reports without exact reproduction steps, reports without video evidence, and reports that do not credibly demonstrate a High or Critical security impact will not be considered.

Evidence must be obtained without violating the testing restrictions in this policy. Video evidence must document the observed behavior and its security implications. Researchers must not perform additional testing, access unauthorized information, bypass security controls, or exploit a vulnerability to produce evidence.

Do not include passwords, authentication tokens, other users' private information, or unnecessary sensitive data in submissions.

5. Report assessment and rewards

For an eligible submission, Bananote assesses the affected functionality, the nature and severity of the vulnerability, its potential impact, the credibility and completeness of the supplied evidence, and whether the issue is already known or has previously been reported.

A monetary reward may be issued for an accepted, verified High or Critical severity vulnerability. Multiple reports describing the same underlying vulnerability will generally be treated as a single finding, even when different endpoints or application features are affected.

Where multiple researchers independently report the same vulnerability, priority will generally be given to the first sufficiently detailed and valid submission received.

Bananote may request clarification or additional information to assess an eligible report. Researchers must not conduct prohibited testing or further exploitation to provide it.

6. Response and communication

For reports that meet the program's eligibility requirements, our target response times are:

These are target response times, not guaranteed resolution deadlines. Complex vulnerabilities may require additional investigation, coordination, or remediation time. Reports that do not meet the program's eligibility requirements will not receive a response.

If a report is accepted for a monetary reward, Bananote will communicate the reward decision and payment arrangements directly with the researcher.

7. Responsible disclosure

All vulnerability reports must remain private while Bananote investigates and addresses the issue.

Researchers must not publicly disclose vulnerabilities, technical details, proof-of-concept material, or information that could enable others to exploit an issue before coordinating disclosure with Bananote and receiving written confirmation that disclosure is appropriate.

Our general target is to coordinate disclosure within 90 days of receiving a valid report. This may be adjusted depending on the nature, severity, and remediation requirements of the vulnerability.

8. Researcher conduct, data protection and privacy

Participation requires good-faith conduct and compliance with all applicable laws and regulations, data protection requirements, and the restrictions in this policy. Researchers must:

• Limit reports to the explicitly in-scope application.
• Avoid unauthorized access to accounts, systems, or information.
• Never modify, delete, or otherwise alter Bananote data, configurations, or system state.
• Access or collect no more information than is strictly necessary to document an observed issue.
• Respect the privacy of Bananote users, employees, contractors, and other individuals.
• Not share, redistribute, disclose, or use personal, confidential, or sensitive information obtained during research.
• Keep vulnerability details private while Bananote investigates and coordinates disclosure.
• Never threaten disclosure or demand payment in exchange for withholding or disclosing vulnerability information.
• Provide accurate, complete, and honest information in submitted reports.

If personal, confidential, or otherwise sensitive information is unexpectedly encountered, researchers must stop immediately and must not access it further, copy it, disclose it, or use it. Any information inadvertently retained must be securely deleted as soon as it is no longer required for the report and no later than one week after Bananote confirms that the reported vulnerability has been resolved, unless applicable law requires otherwise. This requirement does not authorize researchers to collect or retain information.

Reports must describe a demonstrable security vulnerability with a credible security impact. Reports concerning non-exploitable conditions, general best-practice recommendations, or configuration observations without a qualifying security impact are not eligible for this program. Examples include missing security headers or other recommendations that do not independently demonstrate a qualifying vulnerability.

Bananote may decline a report or withhold a reward where the submission involves prohibited activity, unauthorized access, disruption, misrepresentation, or a breach of this policy.

9. Program administration and legal considerations

Bananote reserves the right to assess eligible reports, determine severity, make reward decisions, and update or amend this program as necessary.

This policy does not authorize any activity that would otherwise violate applicable laws or regulations. It does not grant permission to access, test, or interact with systems, accounts, data, or infrastructure beyond the scope and authorization expressly described in this policy. Researchers remain responsible for ensuring that their activities comply with applicable laws.

The program does not grant researchers permission to access systems, accounts, or information beyond their existing authorization. Submission of a report does not create any additional authorization to test or interact with Bananote infrastructure.

Bananote reserves the right to decline submissions that do not meet the requirements of this program.