Bug Bounty Program
NYYU Bug Bounty Program on BugCrowd
Bug Bounty Program
Help us make NYYU more secure and earn rewards. Report security vulnerabilities through our BugCrowd program.
Security First
Help us maintain the highest security standards. All reports are reviewed by our security team.
Reward Structure
All accepted reports are paid in USDT. The threat level is determined by NYYU security staff.
Scope
In-Scope Targets
Out-of-Scope Targets
Priority Vulnerabilities
- •Business logic issues affecting user assets
- •Payment manipulation vulnerabilities
- •Remote code execution (RCE)
- •Sensitive information leakage
- •Critical OWASP issues (XSS, CSRF, SQLi, SSRF, IDOR)
- •Functions accessing unsafe external links
- •Jsbridge/javascriptinterface vulnerabilities
- •Vulnerabilities causing potential user loss
Severity Levels
Vulnerabilities affecting critical assets: access to hot/cold wallet assets, funds, or private keys.
Vulnerabilities compromising user or business funds, including direct system access or core business compromise.
Similar impact to P1 but with preconditions: unauthorized access, serious SQL injections, high-risk data leaks.
Issues affecting certain users, resulting in access and modification of user information.
SMS spam, leakage of non-sensitive information, and minor security concerns.
Important Rules
- No penetration testing that damages the platform or affects normal operations
- No database modification or data destruction
- No automated scanning tools
- No testing on accounts other than your own
- NYYU reserves the right to final interpretation
Submit your findings through BugCrowd when the program status changes to public
Submit Report