While we do not have an official security bounty or reward program, we do appreciate if users detect and notify us of any behaviour in Planio that is out of the ordinary or may be related to the security of our user's data.
In some cases, we may also reward users in cash for security related bugs found and reported in a responsible manner. If a reward will be paid and the potential reward amount will always be determined by Planio and depends on the severity of the issue. As a general rule, rewards will only be paid if the bug has been reported to Planio and Planio only and has not been exploited in order to access, modify, or otherwise compromise our user's data.
In general, we will pay out between 100.00 Euro and 1,000.00 Euro for qualifying security related bugs found. In special cases, where the bug or the potential impact on Planio and our user's data is of extraordinary importance, we may choose to pay out a higher reward.
If you believe that you have found a qualifying security issue, please report it to security@plan.io in a timely manner and do not share the issue or any reference to it with any third parties. Please use email encryption (download our OpenPGP public key) when you contact us.