Amnpardaz Bug Bounty Program
Discover vulnerabilities and receive rewards from Amnpardaz.
The Amnpardaz Bug Bounty Program invites cybersecurity researchers and security specialists from around the world to identify hidden vulnerabilities within our systems. Each valid finding contributes to strengthening digital security and may qualify for rewards valued up to the equivalent of several million tomans.
How Does the Amnpardaz Bug Bounty Program Work?
Amnpardaz has allocated a grand prize equivalent to USD 110,000 for qualifying bug bounty findings. Previously, this program was available only to selected security researchers. In line with Amnpardaz's ongoing objective of strengthening cybersecurity and digital trust, the program details are now publicly available to the broader security community. The program is conducted across two categories: Amnpardaz products and infrastructure systems.
Product Bug Bounty Program
Systems Bug Bounty Program
Eligible Products and Conditions:
Latest version of the Amnpardaz Anti-Ransomware solution.- Latest publicly available version of Amnpardaz antivirus products at the time of reporting, including Amnpardaz Base and Amnpardaz Corporate.
- For beta-version reports, the latest beta release must be tested.
- Windows 10 or later, fully updated and without unauthorized modifications.
USD 110,000 Grand Prize
Vulnerabilities that enable remote exploitation outside the target network through man-in-the-middle attacks against supporting services, allowing malicious code execution with unrestricted privileges, without user awareness, and with persistence after system restart.
Additional Notes
- Reward amounts are determined proportionally based on the vulnerability score under the CVSSv3 standard.
- Reports containing complete technical details and clear PoC source code may qualify for higher rewards.
- Reports related to new malware detection or issues addressable through signatures, unpackers, or similar methods are excluded from this program.
- To review the definitions of RCE, LPE, and other technical terms used within the Amnpardaz Bug Bounty Program, please refer to the following article:
Executive Steps:
by the participant, following the report format specified in this program.
Report Submission Format
To ensure accurate review and communication, submitted reports must follow the formats below.
For infrastructure-related reports, a HAR file generated during exploit execution must also be attached (Guide)
Program Requirements
- To participate in the program, reports must be submitted exclusively to bug@amnpardaz.com and follow the required format.
- Submitted reports must include a PoC code sample or, at minimum, precise reproduction steps that can be executed and tested on an installed product environment.
- The vulnerability must be reported under responsible disclosure principles. Reports are not eligible if vulnerability information, with or without technical details, has been shared with third parties. Additionally, both parties must sign a non-disclosure agreement before payment is processed.
- Members of the Amnpardaz team, employees of Amnpardaz, and their immediate family members are excluded from participation.
- Before submission, please review the Bug Bounty Program Guide: https://kb.amnpardaz.com/en/2018/274/definitions-and-terms-of-the-Amnpardaz-bug-hunting-award-program/
Cases Outside the Bug Bounty Program
The Amnpardaz security team also accepts security-related reports concerning other systems and products developed by Amnpardaz Software Company. Researchers and security specialists may submit reports outside the formal bug bounty program through the following channels: