Acceptable Use Policy
Purpose
This Acceptable Use Policy defines conduct prohibited on Descrimen. The policy supplements the Terms of Service and Bug Bounty Policy. Violations may result in immediate account termination and forfeiture of pending payouts.
The policy applies to all users—researchers and program contacts—regardless of jurisdiction.
Scope of Testing
Researchers must only test assets explicitly declared in scope by a program. Attacking infrastructure that is not in scope is prohibited. This includes assets owned by the program but not listed in the brief, and assets owned by third parties that interact with the program.
Probing adjacent systems "to see if they are vulnerable" is not permitted. If a researcher is unsure whether an asset is in scope, the researcher must ask before testing.
No Exploitation Before Payout
Researchers must not exploit a finding before payout. Demonstrating a vulnerability to the program through a controlled proof of concept is permitted. Leveraging the vulnerability for personal gain, accessing unrelated data, or executing transactions beyond what is needed to prove impact is prohibited.
If exploitation is required to prove impact, the proof must be minimal and reversible. Researchers must not retain access after the proof is captured.
No Sale of Findings
Researchers must not sell findings to third parties. A finding submitted to Descrimen is committed to the program that owns the asset. Selling the same finding to another buyer, to a broker, or to an exploit marketplace is prohibited.
This restriction applies from the moment of submission until the program closes the finding as resolved or as wont-fix. After closure, the researcher's obligations are governed by the disclosure section of the Bug Bounty Policy.
No Threats or Extortion
Threatening or extorting programs is prohibited. This includes:
- Demanding a higher bounty than the published reward table under threat of disclosure
- Threatening to publish a finding if the program does not respond within an arbitrary deadline
- Threatening program team members, employees, or contractors
- Threatening to report the program to regulators unless a bounty is paid
Programs that experience threats should report them through the platform. Descrimen will investigate and may share evidence with law enforcement.
No Money Laundering
The platform must not be used for money laundering. Researchers must not structure payouts to evade KYC thresholds. Programs must not use bounties to move funds to wallets they do not legitimately own.
Descrimen monitors payout patterns for indicators of structuring, layering, and unusual flow. Suspicious activity is reported to the relevant financial intelligence unit where required by law.
Cashout to a charity wallet as a means of routing funds back to the researcher through intermediaries is prohibited. Charity selection is final.
No Sanctioned Parties
Sanctioned individuals and entities are prohibited from using the platform. Sanctions screening runs at KYC initiation and at each cashout above threshold. Researchers on the OFAC SDN list, EU consolidated list, UN list, or HMT list are not permitted to cash out.
Researchers who become sanctioned after registration must notify Descrimen and cease cashout activity. Pending payouts will be held pending legal review.
Use of the platform by an entity owned 50% or more by a sanctioned person is prohibited.
No Multi-Accounting
Operating multiple accounts to farm bounties, manipulate reputation, or evade thresholds is prohibited. Each researcher may maintain one researcher account. Each program may maintain one program account.
Indicators of multi-accounting include shared wallet, shared IP, shared device fingerprint, and coordinated submission timing. Descrimen may merge or close accounts that appear to be operated by the same person.
Bounties earned through multi-accounting are forfeit. Programs that paid the original account are not charged back.
No Submissions on Behalf of Others
Researchers must not submit findings on behalf of another person without disclosure. If a researcher is assisting a colleague, the colleague must be named in the submission and the payout split must be configured in the platform.
Submitting on behalf of a sanctioned party, a minor, or an undisclosed contractor is prohibited. The researcher named on the submission is the party of record for tax and compliance purposes.
No AI Flooding
Using AI to mass-generate low-quality submissions is prohibited. AI may be used to assist research, drafting, and review. Bulk AI-generated submissions that lack manual verification, reproduction, or impact analysis are abuse of the platform.
Indicators of AI flooding include high submission volume in short windows, generic templated text, and findings that do not reproduce. Descrimen may rate-limit or suspend submission privileges for accounts that exhibit these patterns.
A submission that is genuinely AI-assisted and manually verified must be marked as AI-assisted per the Bug Bounty Policy. Marking does not exempt the submission from quality standards.
Enforcement
Violations of this policy lead to immediate account termination and forfeit of pending payouts. Descrimen may also:
- Close pending submissions
- Revoke submission privileges for a fixed period or permanently
- Share evidence with affected programs and with law enforcement
- Pursue civil recovery for damages caused by the violation
Researchers may appeal a termination by writing to appeals@descrimen.example within 14 days of notice. Appeals are reviewed by a panel that was not involved in the original decision.
Programs that violate this policy may have their listing removed and pending findings returned to researchers for resubmission elsewhere.
Changes
Descrimen may update this Acceptable Use Policy. Material changes will be announced 30 days before they take effect.