Discount Mix welcomes responsible reports of security vulnerabilities and bugs that could affect merchants or their customers. This programme gives people a clear way to report issues and lets our team review them consistently.
Submitting a report does not guarantee a reward. We assess whether each report is new, reproducible, and eligible before approving any payment.
Who can participate?
Anyone may submit a report, regardless of age, employment, location, or whether they work as a security researcher. You do not need to be a professional researcher.
What may qualify?
We review reports that demonstrate a real issue in Discount Mix, including security weaknesses and bugs affecting discount calculations, campaign behaviour, or integrations. A valid functional bug does not automatically qualify for a reward.
Impact level | Illustrative examples | Potential reward |
Low | Limited impact, narrow conditions, or a minor issue with a practical workaround. | $10–$49 USD |
Medium | A reproducible issue with meaningful impact on a feature or a group of merchants. | $50–$149 USD |
High | A serious issue that could substantially affect merchant operations, discount outcomes, or data security. | $150–$299 USD |
Critical | A severe, broadly exploitable issue with significant impact on merchants or their customers. | $300–$500 USD |
These ranges are guidance, not guaranteed payments. We choose the final level and amount based on impact, reproducibility, evidence, scope, originality, and the number of merchants affected. We may recognise a report without approving a monetary reward.
Reports may be ineligible for a reward if they are duplicates, already known, not reproducible, outside Discount Mix, or describe unsupported configurations. We will explain our decision where we can.
How to report an issue
Open Discount Mix and use the Help Centre button or Intercom widget in the app to start a conversation and create a ticket.
Select Bug bounty report if that ticket type is available. You do not need a separate submission form.
Describe the issue. Include the affected page or feature, steps to reproduce it, what you expected and what happened, and the browser, device, or app version if relevant.
Include the practical or security impact and attach screenshots, a recording, or other supporting evidence when useful.
The ticket fields are optional. If you do not have every detail, send what you know and we may ask follow-up questions.
Protect people and data. Do not include passwords, access tokens, payment details, or other sensitive information in your report. Do not access another merchant’s data or account.
Safe testing and disclosure
Only test accounts and stores you own or have clear permission to use.
Do not disrupt services, change or delete real merchant data, or perform social engineering, phishing, or denial-of-service testing.
If you encounter another person’s data, stop testing and report what you observed without copying, using, or sharing it.
Keep details of a suspected vulnerability private while we investigate and work on a fix. Please coordinate with us before any public disclosure.
How we review reports
We acknowledge your ticket and review the information provided.
Our team investigates whether the issue is in scope, reproducible, and previously unknown.
We assess the impact and decide whether the report is accepted for a reward. Acknowledgement or validation alone does not mean a reward has been approved.
We tell you the outcome and, if approved, the reward amount and next steps.
Review time can vary depending on the issue and the information available. We do not promise a fixed response or resolution time.
Receiving an approved reward
Rewards are set in USD. After we approve a reward, we may contact you through the ticket to request the information needed to arrange payment. Do not send bank account or other sensitive payment details in your initial report; we will explain how to provide them if a reward is approved.
Some countries, currencies, banks, or payment routes may not be supported. If we cannot arrange payment to your destination, we will let you know. You are responsible for any taxes or reporting obligations that apply to you.
We only request payment details after approving a reward. A report by itself does not create an entitlement to payment.
Frequently asked questions
Do all bug reports receive money?
No. Functional bugs and other valid reports may help us improve Discount Mix but do not necessarily qualify for a reward. We decide whether to approve a reward after reviewing the report.
Do I need to work in security or have a particular job?
No. Anyone may report an issue. No particular employment or professional status is required.
Do I need to complete every ticket field?
No. The fields are optional. Share the information you have in your Intercom ticket, and we may follow up if we need more detail.
When should I provide bank details?
Only after we have approved a reward and asked you for the details needed to arrange payment. Do not include them in your initial report.
Can I publish my findings?
Please keep suspected vulnerabilities private while we investigate and coordinate with us before disclosing them publicly.
Contact us
To report an issue, use the Help Centre button or Intercom widget in the Discount Mix app and select the Bug bounty report ticket type. Share the details you have in its optional fields: affected page or feature, steps to reproduce, observed impact, and environment. We may follow up for more information. We appreciate reports that help keep Discount Mix reliable and secure.