Bounty Program API
Submit vulnerability reports through the Tork bug bounty program. This is a public endpoint — no API key required.
Endpoint
POST
/v1/bounty/submitSubmit a vulnerability reportAuthentication
Public Endpoint
This endpoint does not require an API key. It is rate-limited to 5 submissions per hour per IP address.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
title | string | Yes | Vulnerability title (min 5 characters) |
severity | string | Yes | Severity: critical, high, medium, or low |
category | string | Yes | Category (see valid values below) |
description | string | Yes | Detailed description (min 20 characters) |
steps_to_reproduce | string | Yes | Reproduction steps (min 10 characters) |
expected_vs_actual | string | No | Expected vs actual behavior |
email | string | Yes | Contact email (valid email format) |
Valid categories: policy_bypass, pii_gap, scoring_issue, receipt_integrity, autonomy, other
Example
bash
curl -X POST "https://api.tork.network/v1/bounty/submit" \
-H "Content-Type: application/json" \
-d '{
"title": "PII detection bypass via Unicode normalization",
"severity": "high",
"category": "pii_gap",
"description": "Email addresses using Unicode full-width characters bypass the PII detection engine. For example, ｓａｒａｈ＠ｅｘａｍｐｌｅ．ｃｏｍ is not detected as an email.",
"steps_to_reproduce": "1. Send a /govern request with full-width Unicode email\n2. Observe that no PII is detected",
"expected_vs_actual": "Expected: Email detected and redacted. Actual: Content passes through unredacted.",
"email": "researcher@example.com"
}'json
{
"submission_id": "TORK-BNT-a1b2c3d4",
"status": "received",
"message": "Thank you for your submission. Our security team will review it within 48 hours."
}Response
| Field | Type | Description |
|---|---|---|
submission_id | string | Unique ID (format: TORK-BNT-{hex}) |
status | string | Always "received" on success |
message | string | Confirmation message |
Error Responses
| Status | Description |
|---|---|
400 | Validation error — missing required fields, title too short, invalid category, etc. |
429 | Rate limit exceeded (5 submissions per hour per IP) |
500 | Internal server error |