Bug Bounty Program

Bug Bounty Program

• Let’s make technology safer, together.
• 
  
• 
  
• At Oen Tech we believe technology should serve people—securely and reliably.
• 
  
• To protect our users’ privacy and transaction security, we invite the global security community to stand with us: find and fix potential risks so our products become stronger and safer.
• 
  
• Every vulnerability you discover is a chance for us to improve.

Why participate?

• Cash rewards for every valid, eligible report
• Your research may safeguard tens of thousands of users
• We value every reporter and will credit you publicly (with your consent)
• Become a driving force in building one of Asia’s leading security cultures at Oen Tech

How to join?

Vulnerabilities we care about

• Privilege escalation, account impersonation, auth-bypass flaws
• Data leakage or improper protection of sensitive info
• API security issues (IDOR, unauthorized access, etc.)
• Business-logic errors in the payment flow
• Web / App bugs (XSS, CSRF, SQLi, …)
• Payment or collection-flow security design issues

In-scope assets

Reward guidelines (CVSS-based)

• We assess severity, report quality, and reproducibility.
• Providing a PoC, demo video, or remediation suggestion will boost the reward.

Reports we do not accept

• DoS / DDoS tests
• Social-engineering / phishing
• Testing other users’ accounts / third-party systems
• UI bugs with no security impact
• Scanner output that hasn’t been validated

Process & timeline

• Submit report
• We reply within five (5) business days
• If valid, we start remediation and keep you updated
• After the fix, we evaluate and pay the bounty
• With your permission, you’ll be added to the Oen Tech Hall of Fame

Recognition

• Every six months we publish a Top Contributors list on our website to honour your work (anonymous option available).
• Feel free to mention this program on your resume, blog or social channels.

Oen Tech Responsible Disclosure Policy

• No legal action against good-faith researchers who follow this policy.
• We respond with transparency and respect.
• Fair rewards based on severity and report quality.
• After remediation, you’re welcome to publish your research—we’ll gladly credit you.

• Launch DDoS attacks, spam or excessive requests causing outages.
• Use social engineering, phishing or insider attacks.
• Access, modify, download or delete data/funds that are not yours.
• Test non-public environments (staging, dev) without permission.
• Publicly disclose a bug before we give explicit consent.

Let’s empower technology together.