Sign up with a username, your email and a password of at least 12 characters. We send a 6-digit code to verify the email, then you set up an authenticator app (Google Authenticator, 1Password, Aegis…) by scanning a QR code. Keep the 10 recovery codes somewhere safe: they are the only way in if you lose your phone.
In Settings → Profile add a picture, a short description, your website and location. Choose whether the profile is public (your username appears on hacktivity and the leaderboard) or private (you appear as “a researcher”). You can change your username once every 7 days; nobody else can take a name that is already in use, in any letter case.
On Programs every entry shows its type, top reward and how many reports it resolved. Before testing anything, read the program’s guidelines and scope:
Companies can invite you to private programs. Invitations appear on your dashboard under Private programs, and you also get an email. After you accept, the program appears in your program list with a Private label, and you can report to it like any other program. Please keep what you learn there confidential.
Use Submit a report on the program page. See Writing a good report for what each field means.
When a program awards you a bounty, add your payout details under Settings → Payouts: a bank account (IBAN, checked before it is saved) or a PayPal address. We ask for your password to change them, and we email you whenever they change. They are stored encrypted, and only the RootBounty finance team can read them, only to pay you.
The Earnings list on the same page shows every bounty and its payment: Pending, Being paid, Paid (with the transfer reference) or Failed (with the reason; fix your details and we try again). The bell tells you when a payment is made.
Your dashboard lists every report with its status. The program team replies on the report’s timeline, and you get a notification for every status change, comment and bounty. Accepted and resolved reports are certified findings: they build your reputation and, at ten, unlock posting in the community.