Bug Bounty Program (Discontinued)

Notice: Our paid Bug Bounty Program is now closed.

Like many others in the industry, including major open-source projects like cURL and Nextcloud, we have experienced a massive influx of low-quality, AI-generated vulnerability reports.

This industry-wide trend involves submitters using Large Language Models to generate high volumes of unverified reports. While these submissions often look highly professional, use convincing technical language, and reference real code paths, they frequently detail entirely hallucinated vulnerabilities that lack real-world substance.

Because these AI-generated reports require human security engineers to manually triage and attempt to reproduce the hallucinated findings, the sheer volume of "noise" is overwhelming. The time and resources required to filter out this spam has made the economics of running a paid bug bounty program non-viable for us at this time. By removing the financial incentive, we hope to deter automated spam and refocus our efforts on genuine security improvements.

We want to sincerely thank the legitimate security researchers who have put in the hard work to help us secure Meroton products in the past. Your expertise and rigorous testing have been highly valued.

While we are no longer offering monetary rewards or charitable donations, we remain committed to working with the community to ensure customer data is safe.

If you have discovered a genuine security issue and wish to disclose it, please see our Vulnerability Disclosure Program for guidelines on how to safely report it to our team.