Researchers with ten certified findings (accepted or resolved reports) can publish:
Everyone can read; anyone signed in can like. Share techniques and disclosed work only — details of unfixed issues, personal data or attacks on people are removed by our team.
| Certified finding | Points |
|---|---|
| Critical | 50 |
| High | 25 |
| Medium | 10 |
| Low | 5 |
| Disclosed (bonus) | +5 |
The leaderboard ranks public profiles by reputation, for all time, the last 12 months or the last 90 days.
Medals on your profile for milestones: your first report and first certified finding, ten and twenty-five certified findings, a critical finding, being first to certify a finding on a program, findings on five programs, a disclosed report, €1,000 and €10,000 in bounties, your first post and one year on RootBounty. Locked medals show your progress.
Every medal you earn has its own public page (click it on your profile), with a share image showing the medal. From that page you can Share on LinkedIn, Add to LinkedIn profile (under Licenses & certifications, with the page as the credential link) or copy the link. Medals of private profiles are not public.
Suggestions (next to the leaderboard in the menu) is where you tell us what RootBounty is missing. Verified companies, and researchers with at least one report a program accepted, can send an idea — a one-line title and a short explanation. Everyone with an account can vote for the ones they want most, one vote per person. Everyone can read them. Our team answers under each suggestion and marks it as planned, done or declined; you are notified when yours changes, and you can withdraw it at any time. If your profile is private, your suggestions appear without your name.
Suggestions are public: never describe a vulnerability there. Report security issues through the program they belong to.