Following the hiatus announcement in May, we have used the downtime to implement a spam protection measure and to refine and tighten some of the program scope and rules.
That work is now complete and the Decred Bug Bounty program is open for submissions once again.
To submit a report, bug reporters must now make a $5 USD deposit in DCR. The deposit will be refunded if the report is accepted as a valid security vulnerability. Deposits may also be refunded for reports that are rejected, provided the submission was made in good faith and complied with all program rules and requirements.
Thank you for your patience during the hiatus, and look forward to receiving your reports once again.