Claresia welcomes security research and rewards qualifying vulnerability reports. The public Bugcrowd / HackerOne program launches Q3 2026; until then, report directly to security@claresia.com under our public Vulnerability Disclosure Policy.
Claresia commits to the following when a security researcher reports a vulnerability in good faith:
Activities conducted in good faith and consistent with this policy are authorised. Claresia will not pursue or support any legal action related to your research, will work with you to understand and resolve the issue quickly, and considers your activity authorised under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, and applicable foreign-law equivalents.
| Severity | Reward range | Examples |
|---|---|---|
| Critical | $5,000 – $15,000 | Customer-data exfiltration, account takeover at scale, privilege escalation across tenants. |
| High | $1,500 – $5,000 | Single-tenant data exposure, authentication bypass, persistent stored XSS in admin surface. |
| Medium | $500 – $1,500 | Reflected XSS, CSRF on sensitive endpoints, sensitive information disclosure. |
| Low | $100 – $500 | Configuration weaknesses, security-relevant rate limits, low-impact misconfigurations. |
Until the public program launches, qualifying reports submitted to vdp@claresia.com will be eligible retroactively for these rewards.
Email a clear writeup including: affected URL, reproduction steps, impact assessment, and any proof-of-concept. Encrypt sensitive details with our PGP key (available on request). We acknowledge within 24 business hours.