Amnpardaz Bug Bounty Program
Discover vulnerabilities and receive rewards from Amnpardaz.
The Amnpardaz Bug Bounty Program invites cybersecurity researchers and security specialists from around the world to identify hidden vulnerabilities within our systems. Each valid finding contributes to strengthening digital security and may qualify for rewards valued up to the equivalent of several million tomans.
What is the Amanpardaz Bug Bounty Program?
Amanpardaz has allocated a grand prize equivalent to $110,000 (in Rials) for its Bug Bounty Program. Previously, this program was exclusive to a select group of security researchers. Now, in line with Amanpardaz's long-standing commitment to enhancing user cybersecurity and digital trust, and to encourage participation from all security experts, the program details are being made public. The program is divided into two main categories: Amanpardaz Products and Internal Systems.
Product Bug Bounty Program
Systems Bug Bounty Program
Eligible Products and Conditions:
Latest version of the Amnpardaz Anti-Ransomware solution.- Latest publicly available version of Amnpardaz antivirus products at the time of reporting, including Amnpardaz Base and Amnpardaz Corporate.
- For beta-version reports, the latest beta release must be tested.
- Windows 10 or later, fully updated and without unauthorized modifications.
$110,000 Grand Prize
Bugs that can remotely and from outside the target network, through a Man-in-the-Middle (MitM) attack on backend services (such as the cloud network or signature database updates, etc.) and without the user's knowledge, execute malware code with unrestricted access and remain persistent across system reboots.
Additional Notes
- Reward amounts are determined proportionally based on the vulnerability score under the CVSSv3 standard.
- Reports containing complete technical details and clear PoC source code may qualify for higher rewards.
- Reports related to new malware detection or issues addressable through signatures, unpackers, or similar methods are excluded from this program.
- To review the definitions of RCE, LPE, and other technical terms used within the Amnpardaz Bug Bounty Program, please refer to the following article:
Execution Steps:
Report Submission Format
To ensure accurate review and communication, submitted reports must follow the formats below.
For infrastructure-related reports, a HAR file generated during exploit execution must also be attached (Guide)
Program Requirements
- To participate in the program, reports must be submitted exclusively to bug@amnpardaz.com and follow the required format.
- Submitted reports must include a PoC code sample or, at minimum, precise reproduction steps that can be executed and tested on an installed product environment.
- The vulnerability must be reported under responsible disclosure principles. Reports are not eligible if vulnerability information, with or without technical details, has been shared with third parties. Additionally, both parties must sign a non-disclosure agreement before payment is processed.
- Members of the Amnpardaz team, employees of Amnpardaz, and their immediate family members are excluded from participation.
- Before submission, please review the Bug Bounty Program Guide: https://kb.amnpardaz.com/en/2018/274/definitions-and-terms-of-the-Amnpardaz-bug-hunting-award-program/
Cases Outside the Bug Bounty Program
The Amnpardaz security team also accepts security-related reports concerning other systems and products developed by Amnpardaz Software Company. Researchers and security specialists may submit reports outside the formal bug bounty program through the following channels: