Responsible Disclosure Policy

At Rain, we recognize the value that security researchers provide to our community, and as such, we encourage the responsible disclosure of any legitimate vulnerabilities. Fair compensation will be provided for qualifying discoveries. We encourage researchers to report any findings by sending an email to bugs@rain.com.

What is a qualifying discovery?

A qualifying discovery should directly involve a security vulnerability relating to, but not limited to, the following: website, mobile applications, and other technological infrastructure. Rain will ultimately decide if a discovery is qualifying or not.

Ensure that the report includes:

• Steps and/instructions to reproduce
• Proof of concept
• Recommendations 
• BTC address for compensation
• Allow Rain at least 30 business days to respond

Some examples of discoveries that would not be eligible include:

• Findings related to third parties that do not relate to security of the Rain platform (e.g. support.rain.bh, Intercom chat app, etc)
• Informational bugs that do not have any impact on the security posture of Rain 
• DDoS related attacks
• Issues that have previously been discovered by other researchers
• Failing to provide instructions to reproduce
• Abusing the discovery to negatively impact Rain, or its customers, in any way