Sign up as a company with your legal name, website and country, and set up two-factor authentication. Our team then checks that the organisation exists and that your email belongs to it — usually within two business days. Until then you can complete your profile and upload a logo, but you cannot publish programs or jobs.
Before opening programs or paying bounties, the company account signs the company agreement in Settings → Agreements: with the mouse, or by uploading a copy signed by hand or with a digital certificate. It includes the data processing annex and the permission to mention your company (name and logo) on our website and social networks — never your reports. When its text changes you are asked to sign again. See Agreements.
Several people can handle your programs, each with their own account and a role: administrator, triager or read-only. Invite them in Settings → Team. See Company teams.
Under Visibility in the program editor you choose between a public program, listed for everyone, and a private program, which only the researchers you invite can see. Set it before you submit the program for review.
Once a program is private, the Invitations section lets you invite researchers by username, with an optional message. They get a notification and decide whether to accept. Only members can read the program's scope and send reports. You can cancel a pending invitation or remove a member at any time. Their earlier reports stay with you. Private programs never appear in the public listings or on hacktivity.
The Report inbox lists new and open reports across your programs. On each report you can triage, accept, resolve, or close it as duplicate, informative or not applicable (with a reason the researcher reads). You can also re-score the severity, award a bounty, write internal notes only your team sees, and disclose closed reports on hacktivity. Every change notifies the researcher.
{researcher}, {number}, {title} and {program} are replaced with the report's details. Add the suggested replies creates eight common answers (received, need more information, duplicate, out of scope, fixed…).Besides email and the bell, your notifications can reach the tools your team already uses. In Settings → Integrations (company account and team administrators) connect a channel by pasting its webhook URL:
| Service | Where to get the URL |
|---|---|
| Slack | Apps → Incoming Webhooks → Add to a channel → Webhook URL |
| Discord | Channel settings → Integrations → Webhooks → New webhook → Copy webhook URL |
| Microsoft Teams | Channel ⋯ → Workflows → “Post to a channel when a webhook request is received” |
| Google Chat | Space name → Apps & integrations → Webhooks → Add webhook |
| Your own system | Any public HTTPS endpoint |
Choose New reports (one message per submitted report) or All activity (also researcher comments, collaboration and disclosure requests). Only the subject and a link are sent — for example “New report #42 on Acme” — never the content of a report: whoever follows the link signs in to RootBounty. Webhook URLs are stored encrypted.
For your own endpoint, RootBounty sends a JSON POST (event, subject, url, sentAt) with the headers X-RootBounty-Event, X-RootBounty-Timestamp and X-RootBounty-Signature: sha256=<hex>, the HMAC-SHA256 of <timestamp>.<body> with the signing secret shown once when you connect it. Reject requests whose signature does not match or whose timestamp is more than five minutes old. After 10 failed deliveries in a row an integration pauses; Send a test resumes it.
When you award or raise a bounty on an accepted report, RootBounty creates a payment for that amount. Company dashboard → Payments lists every bounty with its status and totals. Researchers who allow it can be paid by you directly, by bank transfer with a QR code and no fees; the rest are paid by RootBounty on your behalf. See Bounty payments.
Verified companies can publish job offers (Dashboard → Job offers). They appear on the jobs board and your company profile straight away; you can close, reopen or delete them at any time. Each offer has a title, a location (or remote), a description and the link to apply on your careers page.