Security / Bug bounty
Help us protect our customers’ financial data. We reward reproducible security findings that meet the definition below.
Puzzle Financial Inc. · Policy v1.1 · Effective October 23, 2026
A qualifying vulnerability is a reproducible security flaw on an in-scope asset that enables an unauthorized person to:
These outcomes may result from authentication or authorization bypass, account takeover, injection, XSS, SSRF, code execution, or another demonstrated exploit. A vulnerability label or hypothetical chain alone is insufficient.
We pay for the first complete, reproducible report of a qualifying vulnerability. We explain our severity assessment and reward decision, and payment does not depend on when we finish the fix.
Rewards apply only to qualifying vulnerabilities, at every severity. Demonstrate impact safely with synthetic records in accounts you control. Puzzle validates the impact before assigning severity.
| Severity | Example impact | Reward (USD) |
|---|---|---|
| No reward | Reports that do not demonstrate a qualifying vulnerability. | $0 |
| Critical | A qualifying vulnerability with broad or systemic impact across customers, including infrastructure compromise that enables it. | $2,500 |
| High | A qualifying vulnerability with substantial impact, such as account takeover or a cross-company authorization bypass. | $1,000 |
| Medium | A qualifying vulnerability with limited scope and meaningful impact. | $250Amazon gift certificate |
| Low | A qualifying vulnerability with narrow impact or substantial exploitation constraints. | $50Amazon gift certificate |
Low and medium rewards are paid as Amazon gift certificates: $50 for low-severity findings and $250 for medium-severity findings. Certificates are delivered electronically to the email address confirmed with the researcher after validation. These tiers are not paid in cash.
For unusually severe findings, Puzzle may consider an exceptional award individually. Any additional award is discretionary; qualifying reports remain eligible for the published base reward.
Submit your report using the form below. Our team acknowledges it within 3 business days.
Target: 10 business days. We explain eligibility and severity, or what evidence is missing.
After validation and receipt of required payment and tax details. No need to wait for remediation.
If review takes longer, we will explain why and provide an update at least every 10 business days. Business days exclude U.S. federal holidays.
One reward per underlying vulnerability. Related endpoints or symptoms of the same root cause are reviewed together. For duplicates or previously known issues, we will explain the basis without revealing another researcher’s confidential report. You may reply with new evidence or request reconsideration.
Only the exact assets and functionality listed here are authorized for testing under this policy.
| Asset | Coverage |
|---|---|
| app.puzzle.io | Puzzle-operated application functionality and same-origin API requests. Use your own test accounts and synthetic financial data. |
| puzzle.io | Puzzle-controlled website functionality. Rewards follow the same qualifying-vulnerability criteria. |
Other subdomains, third-party platforms, banks, payment providers, accounting partners, and their systems are excluded. A link or integration does not authorize testing the connected service. Ask for clarification through the reporting channel before testing anything outside this list.
Puzzle’s integration, API, and AI features are covered when tested through an in-scope asset. Do not probe a third-party model or provider directly.
Reports must demonstrate a qualifying vulnerability. Include repeatable steps and at least one proof-of-concept attachment. Use synthetic records and accounts you control; do not access, alter, download, or attach another customer’s records.
The following receive no reward unless the report demonstrates a qualifying vulnerability:
Social engineering, phishing, physical attacks, denial of service, and credential stuffing are prohibited testing methods and are never authorized by this program.
We may investigate or fix an informational finding without making it bounty-eligible. Submit one underlying vulnerability per report. Keep follow-up and additional evidence in the existing email thread.
Use only accounts and companies you control, with synthetic data. You may demonstrate cross-company issues between two test companies you own. Do not access real customers’ accounts, download their records, connect another person’s bank account, initiate real payments, or alter production financial records belonging to others.
If you encounter another person’s data, stop testing and report the issue immediately. Do not collect further data or upload that data as proof. Attach a plain-text description of the minimal observation instead of the data itself; we will coordinate safe verification.
Avoid service disruption, destructive testing, high-volume scanning, persistence, and social engineering. Use the minimum testing needed to establish the issue.
Puzzle authorizes good-faith research that follows this policy on the assets listed in scope. We will not initiate legal action against you for that authorized research or accidental, good-faith deviations that you promptly report and help us resolve.
For research covered by this policy, Puzzle waives conflicting restrictions in its Terms of Service on reverse engineering, circumvention, and use of testing tools to the extent necessary for that research. This authorization does not extend to third-party systems or bind third parties.
These program terms control if they conflict with Puzzle’s general website terms about authorized research, report handling, or reward obligations. Otherwise, our Terms of Service and Privacy Policy continue to apply.
To earn a reward, submit the first complete report that enables us to reproduce a previously unknown qualifying vulnerability, comply with this policy, and provide the information legally required to receive payment. A receipt alone is not a validation or reward decision.
Reward eligibility: researchers worldwide who are 18 or older may participate, subject to applicable law and payment restrictions. This eligibility rule overrides any conflicting geographic restriction in the general website terms for participation in this program. Puzzle employees and contractors, and anyone who discovered the issue through work performed for Puzzle, are not eligible for rewards. We accept urgent security notifications even when a reporter is not reward-eligible.
Rewards follow the published schedule. Low-severity rewards are $50 Amazon gift certificates; medium-severity rewards are $250 Amazon gift certificates. We will provide the validation outcome, severity, reward amount and format, and an explanation. Required payment and tax information is requested privately after validation, never in this form.
Keep vulnerability details confidential while we investigate and remediate. We aim to agree on a disclosure date within 90 days of receiving the report; any extension requires mutual agreement. Payment is not conditional on indefinite confidentiality or a separate nondisclosure agreement.
Policy and reward changes apply prospectively. We retain the policy version associated with your report and do not retroactively reduce an earned reward. Changes to authorized testing apply from their published effective date.
We use submitted evidence to validate, fix, and prevent vulnerabilities. You retain ownership of your original research and grant Puzzle permission to use it for those purposes. We handle your contact details and evidence under our Privacy Policy.