Build on good evidence.

Responsible research

Test only with permission. Read exact program scope, excluded assets, permitted techniques, and rate limits before beginning. Submitting a report does not authorize testing, create a contract with an unclaimed website, or guarantee a bounty. Avoid disruption, unnecessary personal data, and retained credentials.

AI is welcome. Evidence is required.

Use your preferred AI tools to organize research, write reports, or review evidence. A person must reproduce and attest to every submitted finding. Treat model output as advice, check it, and protect confidential evidence. The hosted review has no tools, network browsing, code execution, or authority to decide acceptance or payment.

Connect your own tools

Interactive Swagger documentation ↗ · OpenAPI contract ↗

Create a named, expiring key in Keys & settings. Select only the scopes you need. A key sees the same private reports as its owner and is limited to 60 requests per minute. Revocation is immediate. Keys cannot manage domains, finance, organization access, or publication.

GET /api/v1/programs             scope: programs:read
GET /api/v1/reports?limit=25      scope: reports:read
POST /api/v1/reports             scope: reports:write
Authorization: Bearer <your_mbb_key>

Lists use a maximum of 100 items, with a stable UUID cursor in the next_cursor response field. Report submissions require explicit human attestation. Keep keys in your tool’s secret store.

curl https://mayobugbounty.com/api/v1/reports \
  -H 'Authorization: Bearer <your_mbb_key>' \
  -H 'Content-Type: application/json' \
  -d '{
    "title": "A reproducible authorization issue",
    "domain": "example.com",
    "program_id": "",
    "severity": "high",
    "summary": "A detailed, sanitized summary of the issue.",
    "steps": "Steps personally executed and evidence observed.",
    "impact": "Demonstrated security impact and limitations.",
    "ai_used": true,
    "human_verified": true
  }'

Use the command line

The source includes the Mayo CLI. Install from the cli directory with npm install --global ., then run mayo --help. Save named hosted or self-hosted connections, browse programs, submit reports, add comments, and watch ticket status. Supply keys through a secret environment variable or stdin. Saved connections contain metadata only.

mayo connections add hosted --server https://mayobugbounty.com
mayo programs list --json
mayo reports list --all --json
mayo reports submit --file report.json --human-verified
mayo reports watch REPORT_UUID --interval 15 --count 20

Research on mobile

The source includes native iOS and Android companions. Connect hosted or self-hosted installations with a scoped key, read program rules, follow private tickets, submit verified findings and add comments. Native keys use the device secret store. Store distribution is being prepared.

Company sign-in

Organizations can configure Okta SAML sign-in with the hosted operator after verifying their exact email domain. First-time SSO users complete researcher registration; owners then invite their handle to the organization. Company sign-in does not automatically grant access to private reports.

Ownership and disclosure

Organizations prove exact-domain control using a DNS TXT record and an authorized representative’s attestation. A claim stays valid for 24 hours and must be rechecked. An expired claim pauses access. A renewed ownership generation does not inherit historical private reports. Research becomes public only after the author proposes a redacted article and a different verified program manager approves disclosure.

Validation and award records

Programs can offer independent validation with a base award and an optional bonus if the issue persists. Approving competent verification records the base award regardless of whether the result is fixed, persists, or inconclusive. Authors, collaborators, and accepted teammates cannot independently validate their own finding. During this pilot, programs arrange payments externally; Mayo holds no funds and makes no live payouts. An external-payment reference is entered by the organization.

Self-host the core

The source includes a pinned Docker stack, database migrations, permission tests, API tests, browser tests, and an operations runbook. Use an isolated Supabase database, Auth, and REST service. Keep secrets server-side, data on persistent storage, and backups off the host. Do not reuse another application’s database or signing keys.

File uploads, live payouts, subscriptions, automated outreach, and automatic disclosure are not enabled in this pilot. Evidence is stored as sanitized text. The core license is Apache-2.0.