Merge pull request #3521 from Infisical/bug-bounty-program

Add bug bounty program

docs/internals/bug-bounty.mdx

@@ -0,0 +1,60 @@
+---
+title: "Bug bounty program"
+description: " Learn about our bug bounty program and how to report vulnerabilities."
+---
+
+The Infisical Bug Bounty Program is our way of recognizing and rewarding the work of security researchers who help keep our platform secure. By reporting vulnerabilities or potential risks, you help us protect secrets, infrastructure, and the organizations who rely on us.
+
+We value reports that help identify vulnerabilities that affect the integrity of secrets, prevent unauthorized access to environments, or expose flaws in our authentication or authorization flows.
+
+### How to Report
+
+- Send reports to **security@infisical.com** with clear steps to reproduce, impact, and (if possible) a proof-of-concept.
+- We will acknowledge receipt within 3 business days.
+- We'll provide an initial assessment or next steps within 5 business days.
+
+### What's in Scope?
+
+- Vulnerabilities in our cloud-hosted platform (e.g., `app.infisical.com`, `eu.infisical.com`)
+- Security issues in the open source Infisical codebase, as maintained in our official GitHub repository
+- Authentication bypass, privilege escalation, or access to secrets/data without authorization
+
+### Reward Guidelines
+
+Bounties are based on severity, impact, and exploitability, as well as whether the report introduces a new vulnerability class or helps improve an existing fix.
+
+| Severity | Examples | Typical Reward (USD currency) |
+| --- | --- | --- |
+| **Critical** | Full unauthorized access to secrets, authentication bypass, cross-tenant access, RCE, full compromise, etc | $2,000 - $5,000 |
+| **High** | Privilege escalation, project-level access without authorization, persistent DoS | $750 - $2,000 |
+| **Medium** | Info disclosure, scoped DoS (e.g. ReDoS with auth), or minor access control issues | $250 - $1,000 |
+| **Low / Informational** | Missing headers, CSP warnings, theoretical flaws, self-hosting misconfigurations | Recognition only |
+
+
+We may award lower amounts for:
+- Duplicate class vulnerabilities already under review
+- Patch bypasses of previously rewarded issues
+- Vulnerabilities requiring unrealistic attacker conditions
+
+All final reward amounts are determined at Infisical's discretion based on impact, report quality, and how actionable the issue is.
+
+
+### Out of Scope
+
+- Social engineering or phishing
+- Rate limiting issues on non-sensitive endpoints
+- Denial-of-service attacks that require authentication and don't impact core service availability
+- Findings based on outdated or forked code not maintained by the Infisical team
+- Vulnerabilities in third-party dependencies unless they result in a direct risk to Infisical users
+
+
+### Responsible Disclosure
+
+We ask that researchers:
+
+- Avoid accessing data that isn't yours
+- Do not publicly disclose without coordination
+- Use testing accounts where possible
+- Give us a reasonable window to investigate and patch before going public
+
+Researchers can also spin up our [self-hosted version of Infisical](/self-hosting/overview) to test for vulnerabilities locally. 

docs/internals/security.mdx

@@ -118,8 +118,6 @@ It should be noted that, even on Infisical Cloud, it is physically impossible fo
 
 Please email security@infisical.com if you have any specific inquiries about employee data and security policies.
 
-## Get in touch
-
-If you have any concerns about Infisical or believe you have uncovered a vulnerability, please get in touch via the e-mail address security@infisical.com. In the message, try to provide a description of the issue and ideally a way of reproducing it. The security team will get back to you as soon as possible.
-
-Note that this security address should be used for undisclosed vulnerabilities. Please report any security problems to us before disclosing it publicly.
+## Bug Bounty Program
+We run a [Bug Bounty Program](/internals/bug-bounty) to recognize and reward security researchers who help make Infisical more secure. 
+If you've found a vulnerability, please review the program details for scope, disclosure guidelines, and reward tiers.

docs/mint.json

@@ -1520,6 +1520,7 @@
         },
         "internals/components",
         "internals/security",
+        "internals/bug-bounty",
         "internals/service-tokens"
       ]
     },