# Introduction ## About Us Bypassec is an offensive security platform that connects organizations to elite researchers through hacking competitions. Our mission is to provide a collaborative environment where companies can test their systems and identify vulnerabilities before malicious hackers exploit them. In this ecosystem, security researchers act autonomously and are rewarded for the flaws they discover. Simultaneously, companies elevate their protection levels and ensure compliance with essential market certifications such as SOC2, ISO 27001, and PCI DSS. ## Offensive Security Services At Bypassec, we work with two models of offensive security testing: * [Hacking Competitions](/the-platform/hacking-competitions) * [Penetration Testing](/the-platform/penetration-testing) While Penetration Testing follows a classic and structured approach ideal for compliance and discovering vulnerabilities in sensitive internal applications, Hacking Tournaments maximize the search for flaws through the collaboration of hundreds of researchers. {% hint style="info" %} A Hacking Competition does not replace a Pentest, it enhances it 🔥 {% endhint %} ## Our Vision At Bypassec, we believe that application security should be accessible, scalable, and efficient. Our goal is to build a robust community of security researchers and organizations working in tandem to identify and mitigate vulnerabilities before they can be exploited. We are committed to raising the bar for application security by moving beyond the constraints and repetitive cycles of traditional pentesting. Our mission is to foster a global ecosystem of trust, transparency, and high-impact collaboration. # Hacking Competitions ## What is a Hacking Competition? A Hacking Competition is a high-intensity security testing model created by Bypassec to identify system flaws quickly and accurately. We establish a communication channel that connects your company to a global community of security specialists so they can identify and report vulnerabilities in your systems in exchange for rewards. {% embed url="" %} ### How it works in practice 1. **The Collective Intelligence Channel:** During a defined period, we signal to the community that your company is looking for vulnerabilities. This attracts dozens or even hundreds of minds with different skill sets, all focusing on your system simultaneously. 2. **The Reward Pool:** The company sets aside a specific amount (the reward pool) that is destined only for those who find and report real flaws. This ensures that specialists are motivated to find what no one else has seen. 3. **The Report:** Whenever a flaw is found, the specialist uses the Bypassec channel to send a detailed report. We validate the information and deliver the diagnostic ready for your team to fix. 4. **Identification:** Researchers may act independently, but to be rewarded, they must identify themselves and submit a detailed report via Bypassec. Anonymity ends the moment collaboration begins.
## Key Differentiators * **Strength in Numbers:** In the traditional security testing model, you rely on one or two consultants. In a Hacking Competition, you use mathematics to your advantage. If 100 people are testing and no one finds anything, your confidence level is much higher than if only one person said everything is fine. * **Transparency and Redundancy:** Because it is a competition, researchers do not save flaws for later. If one does not report, another will report it within minutes to secure the prize. This ensures that flaws reach you as quickly as possible. * **Triage by Bypassec:** Although the environment is dynamic and open, Bypassec dictates the rules of engagement. We filter all reports, validate what is real, and manage payments. You do not deal with the crowd; you deal with our platform, which delivers clean and actionable diagnostics. * **Financial Efficiency:** If your systems are in order and the specialists do not find critical flaws, we refund part or even 100% of the reward pool. You only pay for the real impact generated by the community. {% hint style="info" %} In summary, a Hacking Competition is the definitive path to security maturity. It is an organized way to mobilize the best minds in the market to work in your favor, ensuring you discover your blind spots before any real risk occurs. {% endhint %} ## Public and Private Competitions Since these competitions function as collective intelligence channels involving external researchers, the applications eligible for this model are those already public and exposed to the internet. Within this framework, two types of tournaments can be conducted: #### Public Competitions In public competitions, the intelligence channel is open to any user on the platform who wishes to report vulnerabilities during the tournament period. These events have a massive reach, with the potential for hundreds of specialists to participate, providing the maximum possible testing depth. #### Private Competitions These are designed for applications that require a controlled number of participants. For example, this model is suitable for applications that need special account creation or specific access that is not feasible for a large group of researchers. In these cases, only a select group of specialists is invited to participate. ### Choosing your Competition
{% hint style="warning" %} Internal applications that contain confidential production data or require the sharing of sensitive information should be tested through our penetration testing services. Hacking competitions are designed to cover the external attack surface, and no sensitive information is shared with researchers during the process. {% endhint %} ## Addressing the Risks It is natural to have the concern: "What if the researcher uses the flaw against me?" The answer lies in the comparison between criminal profit and ethical profit. Today, for a hacker to profit from crime, they must take immense risks: complex anonymity, money laundering, risk of imprisonment, and the uncertainty of whether the victim will pay the ransom. At Bypassec, we offer the opposite path: **fast and clean payment**, **professional prestige**, and **zero legal risk**. The researcher is not our employee, and that is your greatest advantage. They are a free agent motivated by merit. The incentive for them to report the flaw in minutes and receive the prize is mathematically superior to any attempt at extortion. When you have a communication channel to receive vulnerabilities in exchange for rewards, you discourage crime and strengthen your environment. When you do not have one, you are open to attacks 24 hours a day. ## Security through Redundancy In a traditional consultancy, you trust the contract and the assigned professional. If that professional finds something and decides not to report it, no one will know. In a Bypassec Hacking Competition, we eliminate this single point of failure through redundancy. There is no secret kept by one person. We have dozens of independent specialists testing the same perimeter simultaneously. If someone decides to omit a flaw, ten others will find it and report it to guarantee the reward. The competition itself ensures your transparency. # Rewards Model ## Overview At Bypassec, we reward security researchers fairly and proportionally, reflecting the severity of the vulnerabilities found. Our model is designed to ensure that all efforts are properly recognized and incentivized. ### Vulnerability Validation At the end of the tournament, all vulnerabilities will be manually validated by the Bypassec team before their statuses are updated. Incomplete reports or those that do not contain a clear description, reproduction steps, or the required practical evidence exploiting the vulnerability (screenshot or video), will be automatically invalidated and will not be eligible for a reward. {% hint style="warning" %} During the validation process, Bypassec may contact the researcher via email or Discord if the report requires additional information. The researcher will have **48 hours** to respond before the vulnerability is invalidated. {% endhint %} ## Severity Classification The severity levels used to classify vulnerabilities are as follows: * **Informative** * **Low** * **Medium** * **High** * **Critical** Bypassec uses the [CVSS Score 3.1](https://www.first.org/cvss/calculator/3.1) as a reference to classify the severity of vulnerabilities. However, it is important to emphasize that severity may vary based on the impact of the vulnerability, its relevance to the organization, and the ease of exploitation. {% hint style="info" %} In the event of conflicts between the classification model and the specific competition policy, the competition policy will prevail. {% endhint %} ## Reward Pool Distribution Each competition on Bypassec has a reward fund that will be distributed based on the severity of the reported vulnerabilities. Below are the details of the distribution: ### **Low** Severity If only low-severity vulnerabilities are reported: | Severity | Pool Percent | | -------- | ------------ | | Low | 20% | ### **Medium** Severity If medium-severity vulnerabilities are reported: | Severity | Pool Percent | | --------- | ------------ | | Low | 15% | | Medium | 35% | | **Total** | **50%** | ### **High** and **Critical** Severity If high- or critical-severity vulnerabilities are reported: #### Without Critical Reports | Severity | Pool Percent | | --------- | ------------ | | Low | 10% | | Medium | 30% | | High | 60% | | **Total** | **100%** | #### With Critical Reports | Severity | Pool Percent | | --------- | ------------ | | Low | 5% | | Medium | 20% | | High | 30% | | Critical | 45% | | **Total** | **100%** | ### Special Cases {% hint style="info" %} If a specific severity level in the table is not reported, its percentage of the fund will be distributed equally among all higher severity levels. {% endhint %} ## Duplicate Vulnerabilities At Bypassec, duplicate vulnerabilities are also rewarded. If a vulnerability is duplicated, the reward for that specific flaw will be divided among all researchers who reported it. For example, let’s imagine that four reports were submitted: **A**, **B, C** and **D:** * Report **A** is a unique vulnerability * Reports **B**, **C**, and **D** are the same vulnerability In this case, the three identical reports will split the prize allocated for that vulnerability. The distribution would be as follows: | Report ID | Reward | | --------- | ---------------------------------------------- | | A | $ **X** | | B | $ **X / 3** | | C | $ **X / 3** | | D | $ **X / 3** | This reward model ensures that all researchers who contribute to the security of the application are recognized, even when reporting duplicate vulnerabilities. ## Points For every valid vulnerability reported, the researcher will receive points. This score will be used to determine the researcher's position in the Bypassec global ranking and define their performance. ### Points Distribution Points are distributed based on the severity and uniqueness of the vulnerability found. | Severity | Unique | Duplicate | | ----------------------------------------------- | ------ | --------- | | **Low** | 10 | 5 | | **Medium** | 20 | 10 | | **High** | 30 | 15 | | **Critical** | 40 | 20 | ### Why earn points? Scores are the metrics used by Bypassec to identify the top researchers on the platform. These researchers will have the opportunity to receive exclusive advantages and rewards, such as: * Invites to private competitions * Job interview opportunities * Bypassec merchandise and swag * Reward bonuses * Discounts on mentorships and courses from Bypassec partners {% hint style="info" %} These advantages will be defined and distributed spontaneously at specific periods determined by Bypassec, serving as an incentive for researchers. None of the items described above constitutes a guarantee or should be viewed as a mandatory obligation to be provided by Bypassec. {% endhint %} # FAQ
How are rewards calculated? Each tournament on the platform has its own reward fund, for example, $50,000.00. At the end of the tournament, this fund is distributed among the valid vulnerabilities reported to reward the researchers. The specific distribution process is documented in detail on the [Reward Model](/the-platform/hacking-competitions/rewards-model) page.
Why do competitions have different reward pools? When creating a competition, Bypassec performs a calculation to define a minimum value that the company must deposit into the reward fund. This calculation takes into account the complexity of the scope, size, and duration of the tournament. However, host companies may choose to provide more rewards than the minimum value to attract more researchers.
Which vulnerabilities are accepted? Each competition will have its own defined testing policy and scope. The classification of vulnerabilities is specified in the [Reward Model](/the-platform/hacking-competitions/rewards-model) section.
How are payments made? All payments are made via paypal. For this reason, Bypassec requires researchers to have all their information properly filled out in the payment section of their account. Payments are processed simultaneously on a set date, no later than 10 business days after the end of the competition.
Are duplicate reports also paid? Yes, duplicate vulnerabilities are also paid. Our platform and reward model allow us to offer this flexibility without compromising the researchers' earnings.
How are reports validated? All reports are validated by Bypassec before being passed on to the competitions's host company.
# Researchers # Reporting Findings ## Introduction After registering as a researcher on the platform, you will gain access to available competitions and can begin reporting your first vulnerabilities. ## Competition Types At Bypassec, we offer two types of tournaments: * **Public**: Accessible to all researchers. * **Private**: Restricted to high-performing researchers selected by Bypassec. To view available competitions, access the "**Competitions**" tab within the platform.
Each competition has its own testing policy and scope, which can be viewed by clicking on the competition. {% hint style="warning" %} It is **strictly prohibited** to conduct tests on assets that are not explicitly defined in the scope section, as described in the Terms and Conditions of the platform. {% endhint %} ## Reporting Vulnerabilities To report a vulnerability, fill in all available fields and describe the exploitation process in detail.
Once you have reported a vulnerability, you can track its progress in the "Dashboard" tab.
## Report Validation When vulnerabilities are reported, they undergo a validation process by the Bypassec team before their status is updated. Incomplete reports or those lacking a clear description and reproduction steps will be automatically invalidated and will not be eligible for a reward. Similarly, vulnerabilities that do not demonstrate a relevant impact on the organization will be considered invalid. {% hint style="info" %} Reports are validated only after the tournament has concluded. {% endhint %} The available statuses are: * **Pending:** The vulnerability has been reported and will be validated by Bypassec at the end of the competition. * **Duplicate:** The vulnerability is valid and has also been reported by other researchers. * **Valid:** The vulnerability is valid and unique. * **Invalid:** The vulnerability is invalid and will not be eligible for rewards. {% hint style="warning" %} During the validation process, Bypassec may contact the researcher via email or Discord if the report requires additional information. The researcher will have **48 hours** to respond before the vulnerability is invalidated. {% endhint %} ## File Uploads All evidence regarding the reported vulnerability must be submitted through the platform's native upload feature. {% hint style="danger" %} It is **strictly prohibited** to store or submit evidence using applications that make them publicly available without any protection or credentials. {% endhint %} # Receiving Payments {% hint style="info" %} We emphasize the importance of keeping your payment information accurate and up to date to avoid delays or issues in processing your payments. {% endhint %} ## Introduction When vulnerabilities are reported, they undergo a validation process by the Bypassec team before their final statuses are updated. Only vulnerabilities marked as Valid or Duplicate are eligible for rewards. Payments are processed by Bypassec via PayPal within 10 business days after the end of the competition. ## Payment Settings To receive payments, users must complete all requested information in the payment tab within their profile settings.
## Track Payments Payments are displayed in the "**Payments**" tab of the platform. You can download the proof of payment for each transaction by clicking the "download" button on each item.
# Penetration Testing ## What is Penetration Testing? A Penetration Test (Pentest) is a structured, hands-on security assessment where certified offensive security experts systematically simulate real-world cyberattacks against your applications, APIs, and infrastructure. The primary goal of a pentest is to proactively uncover security vulnerabilities, evaluate the business impact of potential exploits, and provide full control over the testing methodology to guarantee complete 360° scope coverage, especially for sensitive and non-public applications.
### Pentest vs. Hacking Competitions: Understanding the Difference Both Penetration Testing and Hacking Competitions operate within defined timeframes, strict rules of engagement, and defined scopes, making both models fully compliant with market regulations and audit standards. However, they fulfill different tactical roles: * **Penetration Testing:** Designed specifically for internal, sensitive, and non-publicly exposed applications. It provides complete control over the testing methodology and guarantees 360° deep coverage across every component, endpoint, and user privilege level within your scope. * **Hacking Competitions:** Designed specifically for the external perimeter. By leveraging hundreds of independent specialists simultaneously, competitions maximize vulnerability discovery, finding on average 3x to 5x more flaws than a standard pentest on external-facing assets. {% hint style="info" %} Use Penetration Testing to secure your confidential internal applications with guaranteed 360° coverage and custom testing control. Use Hacking Competitions to maximize vulnerability discovery across your external, public-facing attack surface. {% endhint %} ## Testing Capabilities Across Various Scenarios At Bypassec, our security researchers possess the technical depth and versatility to perform targeted penetration tests across diverse architectures, technologies, and operational environments. We adapt our testing procedures to evaluate your unique threat vectors and business context.
## Testing Approaches Depending on your security goals, architecture exposure, and threat model, Bypassec offers three standardized pentesting approaches:
{% stepper %} {% step %} ### Black Box * **How it works:** Researchers are given zero prior knowledge about the target application's internal structure. * **Simulated Threat:** Represents an external, unauthenticated attacker attempting to breach your perimeter. * **Best Used For:** Evaluating initial access defenses and unauthenticated attack surfaces {% endstep %} {% step %} ### Gray Box * **How it works:** Researchers are provided limited information, such as user credentials (low and high privileges), API documentation, or role architectures. * **Simulated Threat:** Represents an authenticated user, malicious insider, or attacker who has compromised a standard user account. * **Best Used For:** Deep assessment of business logic flaws, privilege escalation (vertical and horizontal), authorization bypasses, and multi-tenant isolation in internal/sensitive apps. {% endstep %} {% step %} ### White Box * **How it works:** Researchers receive full transparency into source code, architecture designs, API specifications, and database schemas. * **Simulated Threat:** Represents a worst-case scenario with full insider knowledge or a comprehensive pre-release code review. * **Best Used For:** Identifying deep architectural flaws, complex logic vulnerabilities, and hidden code-level risks. {% endstep %} {% endstepper %} ## Compliance & Market Standards Bypassec offensive security assessments fulfill the mandatory technical security requirements for major regulatory frameworks and industry certifications: * **ISO/IEC 27001**: Satisfies technical vulnerability management and security review requirements (Controls A.12.6.1 and A.18.2.3). * **SOC 2 Type II**: Demonstrates adherence to trust service criteria for Security, Confidentiality, and Availability. * **PCI DSS 4.0**: Meets Requirement 11.3 for regular technical security assessments of payment processing environments. * **LGPD / GDPR & HIPAA**: Proves due diligence in protecting sensitive personal identifiable information (PII) and health records. {% hint style="info" %} Generate formal, audit-ready compliance certificates directly from your Bypassec dashboard upon test completion. {% endhint %} # Terms and Conditions ### 1. Introduction Welcome to bypassec.com, a platform offered by Bypassec Labs Ltd. By accessing and using our website, you agree to comply with and be governed by the following Terms and Conditions. These terms are governed by the laws of the British Virgin Islands. Continued use of the Platform (as defined below) constitutes tacit acceptance of these Terms. ### 2. Definitions * **Platform**: Refer to the website bypassec.com. * **User**: Any individual who accesses or utilizes the platform. * **Asset**: An application, IT system, network, technology, infrastructure, software, or other target communicated by a Company in its Hacking Competition for the purpose of having its security evaluated by Researchers. * **Ethical Hacking**: The process of attempting to breach a network or computer system and bypass system security for the purpose of identifying potential security vulnerabilities and informing the system owner of such vulnerabilities. It may also involve an attempt to exploit identified vulnerabilities to determine the extent to which unauthorized access or malicious activities are possible. Ethical hacking is considered "ethical" because the hacker has good intentions and discloses the identified vulnerabilities to the system owner so that system security can be improved. * **Company**: A client of Bypassec that utilizes the platform to create Hacking Competitions to test its Assets and discover vulnerabilities. * **Researcher**: Independent security researchers (ethical hackers) willing to participate in one or more Hacking Competitions. Researchers may act in a professional or non-professional capacity, and each may have different levels of experience and knowledge. Anyone who initiates Ethical Hacking activities within the context of a Hacking Competition is considered a Researcher. * **Hacking Competition**: A temporary program created by a Company for the purpose of authorizing Researchers to test the security of its Assets in order to discover vulnerabilities. * **Company Data**: Any information, files, personal data, or other data that becomes known to a Researcher, or to which a Researcher obtains access, in the context of their participation in a Hacking Competition. Non-limiting examples of Company Data include the description of the Company’s Hacking Competition, information about the Asset, Vulnerabilities, login credentials provided to Researchers, or any data related to the Asset or its connected environments. * **Vulnerability**: A bug, defect, weakness, design or execution error, or any other technical error that compromises the security of information or communication technologies. A Vulnerability can lead to an unexpected or undesired event and can potentially be exploited by malicious third parties to compromise the integrity, availability, or confidentiality of a system and cause damage. ### 3. Operation Bypassec created the Platform as a communication tool where Companies can connect and interact with Researchers. By creating one or more Hacking Competitions, Companies can use the Platform to have the security of their Assets evaluated by the Researcher community and receive information regarding identified Vulnerabilities. Researchers operate on the Platform independently and voluntarily, freely determining which Hacking Competitions they wish to participate in and the time they wish to dedicate. Upon identifying a Vulnerability, they must disclose it to the Company through the Platform by creating a descriptive report of the discovery. Bypassec facilitates this interaction but does not assume responsibility for the specific content of the Hacking Competition or the reports. ### 4. Independent Relationship and Scope of Service Bypassec acts solely as a communication and disclosure channel to intermediate the receipt of security reports between Researchers and Companies. Bypassec does not control, supervise, or have any authority over the Researchers. Researchers are not employees, agents, personnel, or subcontractors of Bypassec and are not authorized to act on behalf of Bypassec. The Company acknowledges and agrees that Bypassec is not responsible for and has no control over the specific individuals who choose to report vulnerabilities. Bypassec's sole function is to provide a collective intelligence channel that connects the Company to the security researcher community to incentivize the disclosure of vulnerabilities. Nothing in this Agreement is intended or should be construed to create a partnership, joint venture, or employer-employee relationship between the Researchers and Bypassec, or between the Company and any of Bypassec’s employees, agents, or contractors. ### 5. Registration and Eligibility By creating an account on the Platform and participating in a Hacking Competition, users must provide accurate, up to date information and agree to comply with these Terms and Conditions. If you do not agree with any term, you are not authorized to participate in Hacking Competitions or access Assets. Your account is strictly personal, and you must maintain the confidentiality of your account credentials. By creating an account on the Platform, users declare, confirm, and warrant that: * They have the right, power, and authority to enter into these Terms and Conditions, to become a party to them, and to fulfill their obligations hereunder. * They have reached the age of 18 (or have reached the age of 16 and have permission from their parents or guardians). * They are not subject to legislative or other measures that prohibit them or Bypassec from entering into these Terms and Conditions with each other. * They are not prohibited from performing Ethical Hacking activities by law, by their organization or employer, by any agreement they have entered into, or otherwise. ### 6. Creation and Participation in Hacking Competitions #### 6.1 Creation of Hacking Competitions Companies may create Hacking Competitions by specifying the scope, duration, and rewards offered. Bypassec reserves the right to review and approve all competitions before they are published on the platform. #### 6.2 Participation of Researchers Researchers may participate in active Hacking Competitions and submit vulnerability reports within the defined scope. By submitting a report, the researcher agrees that the information provided is accurate and is their own original discovery. ### 7. Report Submissions To ensure clarity, security, and efficiency in the process of identifying and validating vulnerabilities reported on the Bypassec platform, the user agrees to adhere to the following items: **Vulnerability Reporting**: * All identified vulnerabilities must be reported exclusively through the Bypassec platform. * Vulnerabilities may only be reported during the specified competition period. **Submission of Evidence**: * Every vulnerability report must include practical evidence demonstrating the exploit to prove the vulnerability. This evidence must be strictly provided in the form of a clear screenshot or a Proof of Concept (PoC) video. * All evidence related to vulnerabilities must be submitted solely using the upload functionalities available on the Bypassec platform. * The use of third-party upload services not included in the Bypassec platform is strictly prohibited, unless prior authorization is granted by Bypassec. **Vulnerability Classification**: * The classification of the severity of each vulnerability will be performed following the processes described on the [Reward Model](/the-platform/hacking-competitions/rewards-model) page. * Incomplete reports or those that do not contain a clear description, reproduction steps, or the required practical evidence (screenshot or video) will be automatically invalidated and will not be eligible for a reward. * Vulnerabilities that do not demonstrate a relevant impact on the organization will also be considered invalid. * Vulnerabilities previously reported by the same researcher within a 6-month period will be automatically marked as out of scope and will not be eligible for rewards. **Validation Process**: * During the validation process, Bypassec may contact the researcher via email or Discord if the report requires more information. * The researcher will have a period of 48 hours to respond to Bypassec’s contact. Otherwise, the vulnerability will be considered invalid. ### 8. Payouts #### 8.1 Eligibility The eligibility of vulnerabilities and the rewards to be distributed will follow the calculations and classifications defined in the Reward Model section. Bypassec is responsible for strictly adhering to these calculations to ensure a fair and transparent distribution of rewards for the Hacking Competition. Researchers contracted by Bypassec are also permitted to perform testing and participate in Hacking Competitions. However, to ensure fair participation, researchers contracted by Bypassec will be rewarded only for unique vulnerabilities, meaning those that have not been identified by any other researcher. #### 8.2 Payment Process and Methods Bypassec processes reward payments through authorized third party payment providers. The available payment methods may vary depending on the Researcher’s location. All payments are subject to the final validation of the reported vulnerability and the conclusion of the respective Hacking Competition. #### 8. 3 KYC and Verification Requirements To be eligible for payouts, Researchers must successfully complete a mandatory Know Your Customer (KYC) and identity verification process. This includes providing accurate and up to date information regarding: * Valid government issued identification. * Proof of tax residency. * Complete and accurate banking or electronic payment information. * Any additional documentation required by Bypassec or its payment processors to comply with international financial regulations. By submitting your information for verification, the Researcher acknowledges, consents, and explicitly agrees that their personal data and submitted documentation will be shared with, processed, and securely stored by our designated third-party KYC provider (Veriff) in accordance with applicable data protection laws. Bypassec is not responsible for payment delays, failures, or losses resulting from incorrect or incomplete information provided by the User. Payments that cannot be successfully processed within 3 months due to incorrect information will be considered canceled. The destination account must be held in the same name as the registered and verified identity of the Researcher. #### 8.4 Tax Responsibility All rewards displayed on the platform are gross amounts. As an independent contractor, the Researcher is solely responsible for identifying, reporting, and paying any taxes, duties, or social contributions required by the laws of their country of residence. Bypassec does not perform tax withholding for international payouts, except where strictly required by British Virgin Islands law or specific international treaties. #### 8.5 Geographic Restrictions and Prohibited Jurisdictions Bypassec only operates in and processes payments to jurisdictions where it can ensure safe and compliant financial transactions. Currently, Permitted Jurisdictions include Brazil, the European Union, the United Kingdom, the United States, Canada, and Australia. Bypassec strictly prohibits the participation of Users and does not process payments to individuals located in sanctioned or high risk jurisdictions. These Prohibited Jurisdictions include but are not limited to Russia, Iran, North Korea, Cuba, Syria, and the regions of Crimea, Donetsk, and Luhansk. Any attempt to bypass these restrictions using VPNs or other methods will result in immediate account termination and forfeiture of any pending rewards. #### 8.6 Transaction and Conversion Fees All reward amounts listed on the platform are gross figures. To ensure global consistency, all Prize Pools are held and settled exclusively in United States Dollars (USD). If a Hacking Competition is funded by a client in a currency other than USD, the total Prize Pool is converted to USD based on the exchange rate at the exact time the funds are received by Bypassec. A Researcher's final reward is strictly calculated as their earned percentage of this finalized USD Prize Pool. Because Bypassec processes international payouts, if the Researcher's receiving bank account is denominated in a currency other than USD, the calculated USD reward will be converted to the local currency using the exchange rate applied by our payment processors on the exact date of the payout transfer. Furthermore, third-party payment providers and intermediate financial institutions may apply transaction fees, exchange rate margins, or currency conversion charges. By participating, the Researcher acknowledges and agrees that any such fees will be deducted directly from their final reward amount. Consequently, the final net amount received by the Researcher may be lower than the gross reward stated on the platform or initially estimated in other currencies. Bypassec is not responsible for any fees or exchange rates levied by the Researcher's receiving institution. #### **8.7 Payment Schedule and Self-Invoicing** All reward payments are processed automatically by Bypassec. The estimated timeframe for a payout is typically two (2) weeks after the official conclusion of a Hacking Competition. However, this duration may extend indefinitely depending on the volume of reports received. Researchers must wait until the entire triage and validation process for all submissions in that competition is completely finalized before payouts are issued. Furthermore, by receiving payouts on the platform, the Researcher acknowledges and explicitly agrees that Bypassec will issue a self-invoice on the Researcher's behalf. This self-invoice serves to officially justify and document the payout transaction for accounting and compliance purposes. ### 9. User Conduct Users agree to use the platform in an ethical and legal manner, respecting all applicable regulations, the testing policy, and the scope defined by Bypassec for the Hacking Competition. Prohibited activities include, but are not limited to: * Conducting tests on Assets that are outside the permitted scope of the competition. * Using techniques such as (distributed) denial of service attacks (DoS or DDoS), physical and/or social engineering, and/or techniques mentioned in the out of scope section of the Hacking Competition. * Unauthorized disclosure of confidential information. * Using malicious methods that could cause damage to the tested system. * Altering or removing any data or parameters, unless it involves your own data within your own test accounts. * Installing or distributing malware, viruses, or any other technology that could harm the interests or property of the Company or third parties. * Sharing or disclosing information with third parties without the Company’s permission or misusing information or data acquired in the context of a Hacking Competition. * Utilizing credentials that are not in the possession of the user, whether for research purposes, vulnerability discovery, or malicious intent. ### 10. Confidentiality All information and communications received or accessed through the Platform are considered strictly confidential. You must not disclose such information to third parties. Any communication regarding Vulnerabilities must be made exclusively to the Company and Bypassec through the Platform. You must comply with all privacy and personal data processing obligations in accordance with applicable laws, including the BVI Data Protection Act (2021), the General Data Protection Regulation (GDPR), and the General Data Protection Law (LGPD). Any personal data or Company Data accessed must be processed according to the instructions provided by the Company and managed with appropriate technical and organizational security measures. ### 11. Intellectual Property Rights Researchers maintain ownership of the intellectual property rights in their reports. By reporting a Vulnerability, the Researcher grants the Company a non-exclusive license to use, copy, and distribute the content of the report as necessary to evaluate the Vulnerability and improve the security of its systems. Bypassec may also use your reports to operate and manage the Platform. ### 12. Relationship between Company, Researcher, and Bypassec Hacking Competitions and Hacking Competition Conditions are published by or on behalf of the Companies. Bypassec acts as a facilitator and does not assume responsibility for the actions or communications of the Companies or Researchers. Participation in Hacking Competitions is voluntary and independent, without any employment relationship with the Company or Bypassec. ### 13. Communication between Company and Bypassec Submissions and communications within the context of a Hacking Competition may be accessed by both Bypassec and the Company. Bypassec may act as an intermediary in the communication between the parties, but it does not assume responsibility for the content of those communications. ### 14. Responsibility of Researchers Researchers are responsible for ensuring that all their actions comply with the guidelines and practices defined by Bypassec, and they commit to fully following the Terms and Conditions, as well as all policies present in the "Legal Information" section of this documentation. Researchers must act with due diligence and care, ensuring that their activities do not violate intellectual property rights, privacy, or any other rights of third parties. Additionally, it is the responsibility of Researchers to avoid any action that could cause damage to the Assets or other systems related to the platform. Non-compliance with any of these guidelines, Terms, or policies may result in liability for damages, in addition to other sanctions applicable by Bypassec. ### 15. Our Responsibility Bypassec uses reasonable efforts to maintain the Platform securely and functioning correctly, but it does not guarantee continuous operation or access to the Platform. The Platform is provided on an "AS IS" and "AS AVAILABLE" basis. Bypassec is not responsible for the actions or omissions of Companies or Researchers. The aggregate liability of Bypassec is limited to a maximum amount of $ 5,000.00 per claim. Nothing in this agreement is intended to exclude or limit any liability that cannot be excluded or limited by law, and the relevant clauses shall be interpreted accordingly. ### 16. Limitation of Liability Bypassec shall not be held liable for any direct, indirect, incidental, or consequential damage resulting from the use of the platform, including but not limited to the loss of data or service interruption. ### 17. Modifications to the Terms We may revise these Terms and Conditions periodically. Any changes will be communicated to users through the platform. Continued use of the platform after the publication of the changes constitutes acceptance of the new terms. ### 18. Termination Bypassec may, without prejudice to any other rights it may have, at its sole discretion, at any time and with immediate effect, suspend or permanently disable access to your account and the Platform or any part thereof, and terminate any licenses provided to you. Bypassec may do so if it suspects that you are abusing the Platform, not operating in good faith, or have provided false identity information. This also applies if you do not respect the Researcher Terms and Conditions, the scope of any Hacking Competition, or if you violate the Code of Conduct. If your account or access to the Platform is suspended or terminated, you are prohibited from participating in or creating Hacking Competitions and are no longer permitted to access any Asset. ### 19. General Disputes arising from these Terms shall be governed by the laws of the British Virgin Islands and submitted to the competent courts of the British Virgin Islands. The invalidity of any provision shall not affect the validity of the remaining provisions. The failure to claim a right or apply a sanction shall not be considered a waiver of rights. ### 20. Contact For any questions or requests, please contact us at . # Privacy Policy ## 1. Introduction BYPASSEC LABS LTD values your privacy. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our website, bypassec.com. ## 2. Information We Collect ### 2.1 Registration Information When you create an account on our platform, we collect personal information such as your name, email address, phone number, and other information necessary for registration. ### 2.2 Usage Information We collect information about how you use our platform, including interactions with competitions, submission of vulnerability reports, and communication with other users. ### 2.3 Device Information We may collect information about the device you use to access our platform, including your IP address, browser type, operating system, and device identifiers. ### 2.4 Cookies and Similar Technologies We use cookies and similar technologies to improve your experience on the platform. You can manage your cookie preferences through your browser settings. ## 3. How We Use Your Information ### 3.1 Provision of Services We use your information to provide and improve our services, including the creation and management of competitions, processing of rewards, and communication with users. ### 3.2 Communication We may use your information to send updates, notifications, promotional materials, and other communications related to our services. ### 3.3 Security We use your information to protect the security of our platform, detect and prevent fraud and abuse, and comply with legal obligations. ## 4. Information Sharing ### 4.1 With Companies We may share your information with companies that host competitions to the extent necessary for competition participation and management. ### 4.2 With Third Parties We may share information with third-party service providers that assist us in operating the platform, provided they comply with strict confidentiality and security standards. ### 4.3 Legal Requirements We may disclose your information to comply with legal obligations, court orders, or government requests. ## 5. Information Security We implement technical and administrative security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. ## 6. Your Rights ### 6.1 Access and Correction You have the right to access and correct your personal information stored on our platform. To do so, please access your account settings or contact us directly. ### 6.2 Deletion You may request the deletion of your account and personal information, subject to legal obligations and data retention requirements. ## 7. Data Retention We will retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. ## 8. Changes to the Privacy Policy We may update this Privacy Policy periodically. We will notify you of any changes by posting the new policy on our website. Continued use of the platform after the publication of these changes constitutes your acceptance of the new terms. ## 9. Contact If you have any questions or concerns regarding this Privacy Policy, please contact us at . # Code of Conduct This Code of Conduct (CoC) aims to ensure that the companies we work with, whether they are suppliers or CLIENTS of our services, adhere to high standards of fair and respectful treatment of individuals, a safe working environment, and other ethical practices. Bypassec and its subsidiaries continuously comply with the principles of this Code of Conduct and require their suppliers and CLIENTS to do the same. ## 1. Geral 1.1 We expect our suppliers and CLIENTS to comply with all British Virgin Islands (BVI) laws and any other jurisdictions applicable to their business operations, and to possess all necessary licenses and registrations to operate their businesses and provide products and/or services to us. Our suppliers and CLIENTS must respect and support internationally recognized human rights. They must comply with all applicable laws and regulations regarding privacy, personal data processing, and information security, specifically adhering to the BVI Data Protection Act (2021), the General Data Protection Regulation (GDPR), and the General Data Protection Law (LGPD), particularly regarding the personal information of customers and employees. 1.2 We expect our suppliers and CLIENTS to follow the rules of this Code of Conduct and implement appropriate measures to monitor and ensure compliance within their companies and supply chains. ## 2. Labor Practices 2.1 Suppliers and CLIENTS must comply with the labor laws of their respective jurisdictions, including the BVI Labour Code (2010) and the Brazilian Consolidation of Labor Laws (CLT) where applicable. They must follow local regulations regarding working hours, overtime, vacations, compensation, and social benefits, ensuring that their employees have adequate time away from work. Normal working hours and rest periods must comply with the legal limits of the country of operation, ensuring that compensation is, at a minimum, equal to the legal minimum wage. 2.2 Suppliers and CLIENTS must implement health and safety standards in the workplace that meet or exceed the legal requirements of their jurisdiction, ensuring a safe and healthy environment for all workers. 2.3 Child labor is strictly prohibited. Suppliers and CLIENTS must not employ anyone under the minimum legal age for employment in their jurisdiction, which shall not be less than 16 years of age. Under no circumstances shall they allow anyone under the age of 18 to perform work that is hazardous or harmful to their safety, health, or education. 2.4 Suppliers and CLIENTS must respect the right to freedom of association, allowing employees to join or form unions and engage in collective bargaining without fear of reprisal, intimidation, or harassment, in accordance with applicable local laws and international labor standards. 2.5 Forced, bonded, or compulsory labor is prohibited under all circumstances. All work must be voluntary, and employees must be free to leave their employment upon reasonable notice as defined by their local legislation or employment contract. ## 3. Non-Discrimination 3.1 Suppliers and CLIENTS must not practice or tolerate discrimination in their operations or business relationships. 3.2 All policies regarding recruitment, wages, access to training, promotions, terminations, retirements, and other aspects related to employment must be based on equal opportunity, regardless of origin, race, color, religion, political affiliation, sexual orientation, union membership, nationality, social class, gender, pregnancy, illness, disability, or any other characteristic that could lead to discrimination. ## 4. Anti-Bribery and Corruption 4.1 Suppliers and CLIENTS must strictly adhere to all applicable anti-corruption and bribery laws in the jurisdictions where they operate, as well as international standards. This includes, but is not limited to, the BVI Corruption Act, the UK Bribery Act, the US Foreign Corrupt Practices Act (FCPA), and the Brazilian Law No. 12.846/2013. They must not offer, promise, or provide anything of value to Bypassec personnel to improperly influence them or obtain an unfair advantage, nor shall they accept such items from third parties in relation to Bypassec’s business. Gifts, hospitality, or benefits may only be offered or accepted if they are transparent, modest, permitted by relevant local regulations, and consistent with accepted ethical business practices. 4.2 Suppliers and CLIENTS must avoid any situation that creates a conflict of interest and must immediately notify Bypassec of any potential or actual conflict that could influence the integrity of the business relationship. ## 5. Respect for Nature and the Environment 5.1 Suppliers and CLIENTS must conduct their business with respect for nature and the environment, complying with all applicable environmental and sustainability laws in their respective jurisdictions. This includes adherence to the Environmental Protection and Improvement Act of the British Virgin Islands, the Brazilian National Environmental Policy (Law No. 6,938/1981), and any other relevant local or international environmental regulations. ## 6. Money Laundering and Fraud 6.1 Suppliers and CLIENTS must adopt rigorous measures to prevent any direct or indirect involvement in activities involving money laundering, fraud, or other illegal financial practices. Any suspicious transaction must be immediately reported to the competent authorities, in accordance with the BVI Anti-Money Laundering and Terrorist Financing Code of Practice, the Brazilian anti-money laundering laws, and any other applicable international financial regulations. 6.2 Suppliers and CLIENTS must implement internal policies and procedures to prevent fraud and money laundering, ensuring the integrity and transparency of their commercial and financial operations. ## 7. Global Legal Compliance 7.1 All Bypassec suppliers and CLIENTS must ensure that their operations, policies, and procedures are in full compliance with the laws and regulations of the British Virgin Islands and any other jurisdiction where they operate, including Brazil. This includes, but is not limited to, legislation related to commercial practices, environmental protection, labor rights, anti-corruption, privacy, and data protection. 7.2 By working with Bypassec, suppliers and CLIENTS affirm they are aware of and comply with all legal requirements applicable to their specific industry and sector, ensuring continuous fulfillment of these obligations throughout the business relationship with Bypassec. ## 8. Amendments 8.1 Bypassec reserves the right to update this Code of Conduct periodically to reflect changes in legal requirements or business practices. ## 9. Corrective Measures 9.1 Compliance with the principles set forth in this Code of Conduct is essential for Bypassec. Any failure to comply gives Bypassec the right to immediately terminate the business relationship and any active agreements with the supplier or CLIENT. This article shall prevail over any conflicting terms in other agreements between Bypassec and the supplier or CLIENT. # Information Security Policy ## 1. Objective The purpose of the Bypassec Information Security Policy is to ensure the protection of digital information, guarantee the integrity, confidentiality, and availability of user data, and protect the platform against cyber threats and incidents. Bypassec adopts industry best practices to mitigate risks and promote a secure environment for everyone involved in our Hacking Tournament platform. ## 2. Scope This policy applies to all users, administrators, employees, and partners who access or interact with the Bypassec platform. It covers information security and the appropriate use of the company’s systems, data, and digital resources. ## 3. Information Security Principles Bypassec is committed to respecting and protecting the core principles of information security: * **Confidentiality**: Ensuring that information is accessible only to authorized individuals. * **Integrity**: Safeguarding the accuracy and completeness of information and processing methods. * **Availability**: Ensuring that systems and data are accessible and usable as required. * **Authenticity** **and Non-Repudiation**: Validating user identities and the authenticity of transactions to ensure actions cannot be denied later. ## 4. Access and Authentication 4.1. All access to the platform and sensitive data will be protected by strong authentication, with Multi-Factor Authentication (MFA/2FA) established as a mandatory standard. 4.2. Accounts for administrators and users who handle sensitive data will have restricted and tiered permissions based on the principle of least privilege, ensuring access is limited to what is strictly necessary for each role. 4.3. Continuous access monitoring will be implemented to detect suspicious activity and prevent unauthorized access attempts. ## 5. Data Management 5.1. Bypassec collects and stores only the data strictly necessary for the operation of the platform and the Hacking Competition processes (Data Minimization). 5.2. All stored data is encrypted both in transit and at rest, utilizing robust encryption methods to protect personal information and sensitive data. 5.3. User data is classified and handled according to its sensitivity. Data retention will follow specific legal guidelines, ensuring the guaranteed deletion of obsolete or unnecessary data. ## 6. Protection against Threats and Risks 6.1. Bypassec regularly performs vulnerability assessments and penetration tests to identify and remediate security weaknesses within the platform. 6.2. A continuous security monitoring system is maintained to detect anomalous behavior and potential attack patterns. ## 7. Privacy and Personal Data Protection Policy 7.1. Bypassec adopts a rigorous privacy policy to ensure the protection of personal data, in compliance with applicable data protection laws, including the BVI Data Protection Act (2021), the General Data Protection Regulation (GDPR), and the General Data Protection Law (LGPD). 7.2. Users have access to their personal data and may request the correction, update, or deletion of their information as permitted by relevant legislation. 7.3. Personal data collected is used strictly for the purposes disclosed to the user and is never shared with third parties without explicit consent. ## 8. User Responsibilities 8.1. Users are responsible for maintaining the confidentiality of their access credentials and for using the platform in an ethical and secure manner. 8.2. Bypassec strongly recommends that users adopt secure browsing practices, such as using complex passwords, enabling multi-factor authentication, and avoiding password reuse. 8.3. Any suspicious activity, incident, or vulnerability identified by the user must be reported immediately to the Bypassec security team. ## 9. Compliance and Audit 9.1. Bypassec conducts periodic audits of its systems and processes to ensure compliance with security policies and regulatory requirements. 9.2. Audits include the review of security practices, log analysis, access policies, and incident handling procedures. 9.3. If a flaw or vulnerability is detected, Bypassec follows a rapid response process to remediate the issue and minimize potential impacts. ## 10. Training and Awareness 10.1. All Bypassec employees and administrators receive regular training on information security practices and policies. ## 11. Incident Response 11.1. In the event of a security incident, Bypassec maintains an incident response plan that includes: * Identification and analysis of the incident * Containment and impact mitigation * Notification of users and authorities, where applicable * Implementation of corrective measures to prevent recurrence 11.2. Significant incidents will be communicated publicly within Bypassec's documentation, maintaining transparency and a commitment to security. ## 12. Policy Review and Updates 12.1. This Information Security Policy will be reviewed periodically to ensure it remains current with new risks, technological advancements, or regulatory changes. ## 13. Final Provisions By using Bypassec, the user acknowledges and agrees to the terms of this Information Security Policy. Adherence to these guidelines is fundamental to ensuring a secure and collaborative environment within the platform. ## Contact For questions or requests related to information security, please contact the Bypassec security team at . ***