Reports are private. Only the researcher, the program team and RootBounty staff can read a report.
Title disclosure of closed reports is the company's decision: it publishes the title and severity on hacktivity.
Full disclosure needs both parties. The researcher or the company proposes it, and the whole report is published only when the other agrees. Attachments and internal notes stay private; either side can withdraw it.
Researchers don’t disclose on their own while a program is handling a report. If a company does not respond within the time its guidelines promise, contact RootBounty staff — we mediate.
Safe harbour. Programs on RootBounty authorise good-faith research that follows their guidelines and scope. Programs commit not to pursue legal action against it.
Abuse — extortion, testing out of scope on purpose, accessing other people’s data beyond what proves the issue — leads to account suspension.