Bug Bounty Program

Cradl AI (Lucidtech AS) welcomes security researchers who help protect our users and their data. This policy explains how to test responsibly, report vulnerabilities, and qualify for a potential reward.

​

Before you begin

Participation requires a signed non-disclosure agreement (NDA) and written authorization from Cradl AI before testing begins. Contact support@cradl.ai to request participation. Authorization will specify the systems and activities permitted. Signing an NDA alone does not authorize testing. You do not need to sign an NDA to report a vulnerability discovered accidentally. Report it promptly and do not conduct further testing without written authorization.

​

Scope

Testing may be authorized for the Cradl AI web application and public API at api.cradl.ai, only where the services are owned and operated by Cradl AI. Test only the systems and activities expressly covered by your written authorization. Use accounts you control and synthetic test documents. Third-party services, integrations, customer-owned systems, and any other assets are outside this program. If you are unsure whether a system or test is covered, contact support@cradl.ai before testing.

​

Rules for testing

• Act in good faith and comply with applicable laws, this policy, your NDA, and the limits of your written authorization.
• Use only your own test accounts, organizations, and data. Do not access or modify another user’s account or documents.
• Keep testing limited to what is necessary to demonstrate the issue. Do not disrupt services, run denial-of-service or load tests, or use high-volume automated scanning.
• Do not use phishing, social engineering, physical attacks, credential stuffing, or brute-force attacks.
• Do not establish persistent access, deploy malware, or use a vulnerability to explore other systems.
• If you encounter personal, confidential, or customer data, stop immediately and report the issue. Do not download, share, or retain that data; ask us how to handle any inadvertently collected information securely.

​

Report a vulnerability

Email support@cradl.ai with the subject Security vulnerability report. Include:

1. The affected URL, endpoint, or feature.
2. A description of the vulnerability and its security impact.
3. Clear steps to reproduce it and a minimal proof of concept, using test data.
4. Relevant screenshots or request and response examples, with secrets and personal information removed.
5. Your contact details so we can follow up.

Report issues promptly and privately. Do not include passwords, API keys, or customer documents in email. If sensitive evidence is necessary, ask us to arrange a secure way to share it. We will review your report, request additional details when needed, and communicate our assessment and next steps. Response and remediation times depend on severity and complexity.

​

Eligibility and rewards

A report may qualify for a bounty if you signed the NDA and received written authorization before testing, are the first to report a previously unknown, reproducible vulnerability with a meaningful security impact, and follow this policy. Multiple reports with the same underlying cause may be treated as one issue. Eligible reports receive $50 for low-severity vulnerabilities, $500 for medium-severity vulnerabilities, and $1,000 for high-severity vulnerabilities. All amounts are in US dollars (USD). Cradl AI determines eligibility and assigns the severity tier based on the vulnerability’s impact and exploitability. Submitting a report does not guarantee payment. Employees, contractors, and anyone engaged by Cradl AI to assess the affected system are not eligible for rewards for findings made through that work. Recipients must be legally eligible to receive payment and are responsible for any applicable taxes. We may request information needed to process a payment lawfully. The following generally do not qualify for a reward without evidence of a practical security impact:

• Duplicate reports or issues already known to us.
• Automated scanner output or theoretical vulnerabilities without a reproducible exploit.
• Missing security headers, version disclosures, or configuration recommendations alone.
• Vulnerable dependency versions without demonstrated impact on Cradl AI.
• Self-XSS or issues that only affect the researcher’s own session without crossing a security boundary.
• Spam, ordinary product bugs, or AI output inaccuracies without a security impact.

​

Coordinated disclosure

Keep vulnerability details and reports private while we investigate and remediate. Agree on the timing and content of any public disclosure with us in advance. Never disclose customer data, credentials, or other confidential information. Do not threaten disclosure or harm to demand payment. Authorized participants must also comply with the confidentiality obligations in their signed NDA.

​

Safe harbor

We will not initiate or support legal action against you for good-faith research conducted after signing the NDA and receiving written authorization, within the limits of that authorization and this policy. To the extent we can, we waive restrictions in our service terms that would otherwise prohibit such authorized research. This protection does not depend on receiving a reward. This page alone does not authorize testing. We will not initiate or support legal action against you solely for reporting an accidentally discovered vulnerability in good faith, even if you have not signed an NDA or received authorization. This does not authorize further testing. We cannot authorize testing of third-party systems or bind third parties or authorities. If you are uncertain whether an activity is permitted, contact us before proceeding.

​

Program changes

We may update, suspend, or end this program. Changes apply to future testing and submissions; research conducted under an earlier policy remains covered by its safe harbor. Any reward already confirmed in writing will be honored.