Kalender.digital

Members of the Bug Bounty program receive XP for their reports. Each month the bounty pool is split between researchers by their share of that month's XP, so everyone with a measurable contribution gets paid.

$10,000Guaranteed minimum monthly bounty pool, split by each researcher's share of that month's XP

$100For every 1% of the month's XP you earn

$50Minimum payout. Smaller bounties carry over for up to six months until they reach $50

-10%Your bounty is reduced by your rejection rate. Out of scope, incomplete and false positive reports count, so 1 rejected out of 10 means 10% less

No active bounties by the developer

Eligibility and responsibility

We would like to thank everyone who submits valid reports that help us improve the security of Kalender.digital. However, only those that meet the following eligibility requirements may receive a monetary reward for vulnerabilities found in the Kalender.digital source code.

You must be the first reporter of a vulnerability.

The vulnerability must be a qualifying vulnerability (see below).

Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through patchstack.com.

You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit your requests per second). If you over do it, your IP address might be throttled or even (temporarily) blocked to protect our infrastructure. See how.

Reports on vulnerabilities are examined by our security analysts - our analysis is always based on worst case exploitation & the business criticality of the vulnerability, as is the reward we pay.

Qualifying vulnerabilities

Non-qualifying vulnerabilities

Plugin developer? Start a Managed Vulnerability Disclosure Program.

Free for all