generated: '2026-09-14'
method: searched
source: https://www.getbeamer.com/bug-bounty-program
url: https://www.getbeamer.com/bug-bounty-program
http_status: 200
description: >-
  Beamer runs a self-hosted bug bounty program with published guidelines, a dedicated reporting
  address and a stated safe-harbour clause. It is not run on HackerOne, Bugcrowd or Intigriti, and
  there is no /.well-known/security.txt on any Beamer host (all probed 404 on 2026-09-14), which is
  why the automated security-program probe reported none.
program:
  type: bug-bounty
  self_hosted: true
  platform: null
  contact: bugbounty@getbeamer.com
  contact_type: email
  policy_url: https://www.getbeamer.com/bug-bounty-program
  rewards: true
  reward_basis: severity of the finding
  payout_method: PayPal, USD, paid after the bug is fixed
  reward_matrix_published: true
  safe_harbour: >-
    "Security research should be conducted following industry standards and no legal actions should be
    initiated against security researchers, as long as they comply with this policy and guidelines."
  rules:
    - Researchers must use their own Beamer account; testing third-party accounts without consent is prohibited.
    - Automated testing is not allowed.
    - Each bug is treated separately even when reported together.
    - First reporter only; duplicates are unrewarded unless they add information.
    - Reports must be reproducible, with screenshots, video or GIF evidence.
  process:
    - Report to bugbounty@getbeamer.com with enough detail to reproduce.
    - Beamer checks for duplicates and whether a fix is already in flight.
    - Beamer assigns severity, communicates the reward, and reports back on resolution.
    - Reward is paid via PayPal once the bug is fixed.
security_txt:
  published: false
  probed_hosts: [www.getbeamer.com, getbeamer.com, api.getbeamer.com, app.getbeamer.com, help.userflow.com, status.getbeamer.com]
  result: 404 on every host
  recommendation: >-
    A /.well-known/security.txt pointing Contact at bugbounty@getbeamer.com and Policy at the bug
    bounty page would make this existing program machine-discoverable.