Saraf - Bug Bounty Program

┌─ SARAF SECURITY TERMINAL v2.1.3 ─┐ │ 🛡️ Bug Bounty Program Interface │ └────────────────────────────────────┘

root@saraf-security:~$

cat /etc/bounty/program.info

🎯 SARAF BUG BOUNTY PROGRAM ═══════════════════════════ Status: ACTIVE Security Level: CRITICAL Target: saraf.app infrastructure

root@saraf-security:~$

./security-scan --show-objectives

📋 MISSION OBJECTIVES:

Enhance Saraf system security
Recognize white-hat hackers
Collaborate with Iranian cybersecurity community

root@saraf-security:~$

nmap --scope allowed-targets

✅ AUTHORIZED TARGETS:

Domain: saraf.app and subdomains
Mobile: iOS and Android applications
API: Public Saraf endpoints

root@saraf-security:~$

./security-policy --show-restrictions

❌ PROHIBITED ACTIVITIES:

Social engineering & phishing attacks
DoS/DDoS or spam attacks
Automated scanning without coordination
Physical access or duplicate reports

root@saraf-security:~$

./security-scan --help

📧 REPORT SUBMISSION ENDPOINT: dev@saraf.app Required Headers: ├─ Content-Type: detailed-bug-description ├─ Reproduction-Steps: step-by-step ├─ Proof-Of-Concept: if-available └─ Impact-Analysis: security-assessment

root@saraf-security:~$

./bounty-calculator --show-rewards

💰 REWARD MATRIX
┌──────────┬──────────────────────────┬─────────────────────┬──────────────────┐
│ SEVERITY │ DESCRIPTION              │ REWARD (USDT)       │ EXAMPLES         │
├──────────┼──────────────────────────┼─────────────────────┼──────────────────┤
│ 🟥 CRIT  │ System/Financial Control │ 5,000 - 10,000 USDT │ RCE, Payment Byp │
│ 🔴 HIGH  │ Significant Data Access  │ 1,000 - 5,000 USDT  │ SQLi, Auth Byp   │
│ 🟠 MED   │ Limited Real Impact      │ 100 - 1,000 USDT    │ XSS, CSRF        │
│ 🟡 LOW   │ Minor/Conditional Impact │ 10 - 100 USDT       │ Clickjack, Misc  │
│ ⚪ INFO  │ No Current Risk          │ 0 -10 USDT          │ Version Disc     │
└──────────┴──────────────────────────┴─────────────────────┴──────────────────┘

root@saraf-security:~$

cat /etc/bounty/rules.txt

📋 ENGAGEMENT RULES:

Only ethical and responsible reports eligible
Public disclosure before fix = reward void
First report only gets reward
Final decision by Saraf security team

root@saraf-security:~$

./hall-of-fame --status

🏆 RECOGNITION PROGRAM Your name will be listed in our Hall of Fame as a recognized white-hat hacker. Location: /hall-of-fame.html

root@saraf-security:~$

uptime && echo "System ready for security research"

12:34:56 up 847 days, 23:15, 1337 users, load average: 0.00, 0.01, 0.02 System ready for security research

root@saraf-security:~$█