For here, you go find di terms and conditions wey concern our Bug Bounty Program Participants directly. You suppose read dis terms together wit di General Terms for Business Partners (di “General Terms”). Any term wey dem don define wey dem use for dis Bug Bounty Program Terms go get di meaning wey dem give am for di General Terms.
1. Introduction
1.1. Dis terms cover your voluntary participation for Deriv bug bounty program, wey dey give participants financial reward if dem discover and report vulnerabilities or bugs for Deriv software system or networks (di “Program”). If you report vulnerability wey concern any web service wey Deriv own give us, or if you join di Program any oda way, you acknowledge say you don read and agree to dis terms.
1.2. You acknowledge say di Program no be competition, but na experimental and discretionary rewards program.
2. Scope
2.1. Di scope of di Program dem specify am well-well for di Program webpage. If you no sure weda some content fall within di scope of dis Program, send email to security@deriv.com make you check before you make any testing attempts.
3. Eligible participants
3.1. You no fit participate for di Program if:
3.1.1. Your employer or di organisation wey you dey work for no allow you participate for dis kind programs;
3.1.2. You be or you don work for us or any of our group companies;
3.1.3. You be immediate family member of one of our employees or former employees, or of any of our group companies employees or former employees.
3.2. If we know or get reason to suspect say you meet any of di criteria wey dey above, we reserve di right to disqualify you from di Program and withdraw any bounty payments wey we don pay you.
4. Potential rewards
4.1. We reserve di right to decide if di vulnerability report wey you submit qualify for reward. Di decision on weda to pay reward or not na entirely our discretion.
4.2. All our decisions about di amount of any bounty na final.
4.3. Bounty ranges dey depend on di classification and sensitivity of di data wey dem impact, how easy e be to exploit am, and di overall risk to our clients and brand if our Security team confirm say di vulnerability wey dem report na valid security issue.
5. Requirements to submit bug report
5.1. Your submission must follow di guidelines below:
5.1.1. Give complete description of di vulnerability wey you dey report, including how e fit be exploited and di impact.
5.1.2. Provide evidence and explanation of all di steps wey dem need to reproduce di submission, wey fit include:
5.1.2.1. Videos;
5.1.2.2. Screenshots;
5.1.2.3. Exploit code;
5.1.2.4. Traffic logs;
5.1.2.5. Web/API requests and responses;
5.1.2.6. Email address or user ID of any test accounts; and/or
5.1.2.7. IP address wey dem use during testing.
5.2. If you no include any of di items above, e fit delay or put di bounty payment at risk.
6. Disclosure of sensitive information
6.1. You agree say you no go discuss vulnerabilities wey you discover, even di ones wey dem don resolve, outside di Program without our written consent.
6.2. You agree to follow Deriv disclosure guidelines. If you believe say you don discover security vulnerability, make you report am with complete explanation of di vulnerability, according to di submission guidelines wey Clause 5 above set out.
7. Licence
7.1. You hereby give us royalty-free, fully paid-up, perpetual, non-revocable, exclusive, worldwide, transferable, and sub-licensable licence for any report and any feedback wey you give us. You agree say we get unrestricted rights to use di report and feedback. We reserve di right not to use any or all di items wey you give us. You waive any compensation for di incorporation of any materials for a report or any feedback wey you give us about our products and services.
7.2. You also understand and acknowledge say we fit don develop or commission materials wey resemble or dey identical to di submission, and you waive any claims wey you fit get because of any similarities to di submission. You understand say no compensation or credit dey guaranteed for you for di use of di submission.
7.3. You state and warrant say your submission na your own work, say you no use information wey belong to anoda person or entity, and say you get di legal rights to give us di licence for dis Clause 7.
8. Your obligations
8.1. You must not participate for di Program unless you comply with all applicable laws, rules, and regulations as you dey do so. Na your responsibility to familiarise yourself with your local laws and follow dem, as dem fit place additional restrictions on your participation for di Program.
8.2. Na your responsibility to handle any tax implications wey concern your participation for di Program, wey go depend on your kontri of residence and citizenship.
8.3. Your testing must not disrupt or compromise any data wey no be your own.
8.4. You no fit share any content or material wey no dey appropriate.
8.5. You must not infringe on di rights of any third party or take part for any activity wey violate oda pipo privacy.
8.6. You must not take part for any activity wey fit harm us, di Program, or oda pipo, including transmitting viruses.
