Purpose of a Bug Bounty Program
A bug bounty program provides a structured channel for security researchers to report vulnerabilities responsibly. A well-designed program helps a platform identify security weaknesses before they can be exploited by malicious actors.
Responsible Disclosure
Researchers should report vulnerabilities privately through the official security-reporting channel and provide enough information for the security team to reproduce and assess the issue. Public disclosure should follow the program''s current rules and any agreed disclosure timeline.
What a Report Should Include
A useful vulnerability report normally includes a clear description, affected component, reproduction steps, security impact, proof-of-concept evidence where appropriate, and any conditions required to reproduce the issue. Researchers should avoid collecting or exposing unnecessary user data.
Potentially Eligible Findings
Depending on the official program scope, eligible findings may include vulnerabilities that affect authentication, authorization, sensitive data exposure, transaction integrity, API security, or other security-critical functions. The exact scope must be defined by 4M's current bug bounty policy.
Out-of-Scope Issues
Programs commonly exclude issues such as unsupported versions, social engineering, denial-of-service testing that could disrupt users, or findings without meaningful security impact. However, researchers should follow the exact exclusions published by 4M rather than relying on general assumptions.
Researcher Conduct
Security testing should be controlled and should not intentionally damage systems, access unrelated user data, disrupt services, or manipulate real-user assets. If testing could affect production users, researchers should stop and seek guidance through the official disclosure channel.
Rewards and Safe Harbor
Reward amounts, eligibility, safe-harbor language, and disclosure timelines should only be published when officially confirmed by 4M. They should not be inferred from other exchanges' programs.
Important Notice
This page describes the structure and principles of responsible security reporting. It does not claim that a specific 4M bug bounty program, reward schedule, scope, or safe-harbor commitment is currently active unless published in an official 4M security disclosure.