Vault12 Bug Bounty Program

The Bug Bounty Program for Vault12 has been suspended indefinitely. We do not know when, or if, the program will ever be reinstated.

Beginning in Jun 2026 (coinciding with the initial release of Fable), the volume of reports received increased from ~2 reports a month to ~1000 reports a month. For the month of Jun 2026, there were only 11 valid reports - the remainder were either duplicates of those 11 or invalid reports. No new valid reports occurred in the month of August.

While there is no rule prohibiting the use of AI tools to create reports, the volume and nature of the reports we receive are overwhelmingly generated by AI models released in the last few months. Unfortunately it requires an enormous amount of resources from the Vault12 engineering team to check each report for validity. Given the frequency of hallucinated security issues the team made the difficult decision to end the Bug Bounty Programs as we do not have the resources to process such a high volume of reports like many other bug bounty programs.

If you received a paid bug bounty from us during 2019-2026 - we have added your email to our whitelist and you know how to reach us directly. We will fast track reports from those we already have a relationship with while shutting down reviews of public reports from unknown sources.

For everyone else, you are welcome to submit a report to bug-bounty@vault12.com but that inbox will now be triaged by an AI agent that follows strict guidelines and silently rejects any report that is invalid for any reason outlined in our initial guidelines. In the case of a report that is actually valid and not previously reported, a member of our team will reach out to you to discuss next steps.