Security · Coordinated disclosure
Find something. We will pay you and then publish it.
Every valid report reaches the release notes with the reporter credited, and the ones we were slow to fix are marked as slow rather than left out. A programme that only publishes its wins is a marketing page with a mailbox.
What we pay
Bands, published, so nobody has to negotiate
Severity is ours to assess and we will show our reasoning. If you disagree, say so: a band is a judgement, and we will move one we cannot defend.
Cross-tenant access to another company's registers, authentication bypass, remote code execution, or anything that lets a reader be pointed at a system it was never granted.
₦250k – ₦600kFixed in 72 hoursPrivilege escalation inside a workspace, an engagement-scoped credential reaching beyond its scope, or an audit trail entry that can be altered or removed.
₦100k – ₦250kFixed in 7 daysStored cross-site scripting, access-control gaps that expose metadata rather than records, or a way to make a stale register report itself as current.
₦40k – ₦100kFixed in 30 daysIssues with limited impact that still deserve payment and a line in the release notes. We do not close reports as "informational" to avoid paying.
₦15k – ₦40kFixed in 90 daysPaid in naira by transfer within thirty days of triage, no invoice required and no NDA attached. Accepting a reward does not oblige you to stay quiet — the coordination window below is about giving customers time to patch, not about silence.
Scope
What is in, and what we will close as out
Stated up front so nobody spends a weekend on something we will not pay for. Out of scope does not mean unwelcome — it means no reward, and we will still fix it.
In scope · rewarded
The product itself, every endpoint, and the authentication in front of both.
The connectors that read customer systems. The highest-value target here, and the one we most want tested.
Anything that lets a DPCO reviewer reach a register outside the engagement they were granted.
Any way to write a false entry, alter an existing one, or act without producing one at all.
Prompt injection that causes the assistant to act outside its permissions, or to return data from a register the asker cannot reach.
Any way to make a published badge claim more than the assurance behind it supports.
Out of scope · no reward
Send the exploited result, not the report. We will read a scanner output but will not pay for one.
If you can chain it into something real, that is in scope and we will pay for the chain.
Never in scope. Our people are not a test surface and phishing them is not research.
Do not test it. A volumetric test against a production register affects customers who did not consent to your research.
Test in the sandbox we provide. Touching real customer data is the one thing that ends safe harbour.
Reported often, exploitable rarely. Show us a path to another user and it moves in scope.
What happens after you send it
A clock you can hold us to, because we hold customers to one
The product gives companies seventy-two hours to notify a regulator and refuses to let them start the clock late. It would be indefensible to run a disclosure process without dates of our own.
A person acknowledges it
Not an auto-reply. Somebody on the security team confirms receipt and tells you who is handling it.
Triaged, with our reasoning
You get the severity we assigned and why. If you think it is wrong, argue: a band is a judgement and we will move one we cannot defend.
Fixed to the published service level
The window for each band is in the table above. If we are going to miss it we tell you before the date, not after.
Paid
By transfer, in naira, no invoice and no NDA. Payment does not depend on you staying quiet afterwards.
Published in the release notes
Or sooner if the fix has shipped and customers have patched. Your name on it unless you would rather it was not.
Resolved reports
Credited in the release notes, including the late ones
Every resolved report is credited in the release notes, with the reporter named unless they asked not to be, and the ones we were slow to fix are marked as slow. Nothing has come through this register yet, so there is nothing to list — and we will not fill the space with anything that did not happen.
Safe harbour
Research it in good faith and we will not come after you
This is a commitment, not a courtesy. Companies that threaten researchers do not get fewer vulnerabilities — they get told about them later, by somebody else.
We will not pursue you legally
For good-faith research within this scope. No lawsuit, no report to law enforcement, no letter from anybody’s counsel.
Stop at proof, and you are covered
Confirm the vulnerability, then stop. Do not exfiltrate, do not pivot, and do not keep what you found. Tell us how far you went and we will take your word for it.
Customer data ends the protection
The one hard line. Use the sandbox — real customers did not agree to be part of your research, and we owe them that.
You may publish afterwards
Once the fix has shipped and the coordination window has closed. We will not ask you to sign anything that prevents it, and we would rather you did.
Send it to security@asiri.ng
Steps to reproduce, what you accessed, and what you stopped short of. A person acknowledges it within 1 working day — not an auto-reply that says nothing.
Report it
Send us what you found
A person replies within one working day and it is triaged within three. Safe harbour applies to everything on this page — an out-of-scope surface means unpaid, not unwelcome, and you get the same acknowledgement and the same clock.