1.1 The security of our users is a top priority at Astrill. We appreciate the work of security researchers and welcome responsible reports of vulnerabilities in our services. This page explains how to submit a report, what is in scope, the rules you must follow, and how rewards are decided.
1.2 This bug bounty program is a discretionary, voluntary initiative of Astrill. It is not a contest, an offer or a contract. Astrill may modify, suspend or terminate the program at any time without prior notice; the version published on this page at the time of your report governs. All determinations — including whether a report is valid, its severity, eligibility for a reward and the amount of any reward — are made by Astrill at its sole discretion and are final.
2.1 Send your report by email to bugbounty@astrill.com. This is our dedicated address for security reports; please do not submit vulnerabilities through customer support or any public channel.
2.2 A good report contains: a clear description of the issue; the affected URL, service or application (including version); step-by-step instructions to reproduce it; a minimal proof of concept; and your assessment of the security impact. Please submit one vulnerability per report, unless several issues must be chained to demonstrate impact.
2.3 Report a vulnerability promptly after you discover it. Do not stockpile issues.
2.4 We aim to acknowledge new reports within five business days and, where possible, will keep you informed about the progress of remediation.
2.5 Reports that withhold technical details pending a promise of payment (“pay first, details later”) are not accepted.
3.1 In scope are systems and software operated or published by Astrill: the astrill.com website and member zone, the official Astrill VPN applications (desktop, mobile and router software) and the VPN server and API infrastructure that we operate.
3.2 Everything not operated by Astrill is out of scope. This includes, for example, websites of resellers and affiliates, payment processors, app stores and other third-party services that merely integrate with Astrill. Please report issues in those systems to their respective operators.
4.1 The following categories are not accepted under this program and do not qualify for a reward:
(a) vulnerabilities in third-party software or services (see section 5);
(b) publicly known vulnerabilities (e.g. CVEs) identified only from version information, banners or fingerprinting, without a demonstrated compromise of our systems;
(c) denial of service, resource exhaustion, brute-force and rate-limiting findings, and any report whose demonstration requires degrading our services;
(d) social engineering or phishing of Astrill staff or customers, physical attacks against our facilities or infrastructure, and attacks against personal accounts or devices of Astrill staff;
(e) email configuration findings (SPF, DKIM, DMARC and similar) without a practical, working exploit;
(f) missing security headers, cookie flags, clickjacking and similar best-practice observations without a demonstrated, practical security impact;
(g) SSL/TLS configuration observations (supported protocol versions, cipher suites, certificate details) without a practical attack;
(h) self-XSS, and issues that require a victim device that is already compromised, rooted or jailbroken, or that has an attacker-installed root certificate;
(i) open redirects, content spoofing, text injection and tabnabbing without a demonstrated security impact;
(j) username or email address enumeration;
(k) unverified output of automated scanners; and
(l) issues reproducible only in outdated browsers, operating systems or client versions.
5.1 Vulnerabilities in software or services that Astrill does not develop or operate are not part of this program, even if Astrill uses the affected product. Please report them to the respective vendor or project.
5.2 That said, if you discover that Astrill runs a version of a third-party product that is affected by a known vulnerability, we welcome a note about it at bugbounty@astrill.com and will act on it. Such reports are appreciated, but pointing to a public advisory does not by itself qualify for a reward. Where a report demonstrates a concrete, previously unknown exposure of our systems, we may grant a reward at our sole discretion.
6.1 When researching, you must:
(a) test only with accounts and devices that you own or are explicitly authorized to use;
(b) never access, modify or delete data belonging to other users — if you encounter someone else's data, stop immediately and mention it in your report;
(c) limit yourself to the minimal proof of concept required to demonstrate the vulnerability, without pivoting further into our systems and without exfiltrating data;
(d) avoid any action that degrades our services, including high-volume automated scanning; and
(e) keep all information about the vulnerability and about our systems confidential in accordance with section 8.
6.2 Safe harbor: if you conduct your research in good faith and in compliance with this policy, Astrill will not initiate legal action against you or refer your research to law enforcement. This assurance does not extend to conduct that violates this policy or applicable law.
7.1 Rewards are granted exclusively at Astrill's sole discretion. This includes whether a reward is granted at all, its amount and its form. We do not publish a reward table; each report is assessed case by case, based primarily on the demonstrated security impact and the quality of the report.
7.2 A reward can only be considered if all of the following are met:
(a) you are the first to report the issue — duplicate reports and issues already known to Astrill (including from internal testing) are not eligible;
(b) the issue is in scope and your research and report comply with this policy; and
(c) Astrill implements a fix or other change to its systems as a result of your report. If Astrill decides, after investigation, not to change anything — for example because the reported behavior is intended, the risk is accepted, or the issue is out of scope — no reward will be paid and no claim to a reward arises.
7.3 Rewards are paid exclusively in Bitcoin (BTC); no other payout method is offered. To receive a reward you must provide a valid Bitcoin address. If you are unable or unwilling to accept payment in Bitcoin, we will not be able to pay a reward.
7.4 Astrill employees and contractors, their immediate family members, and persons to whom Astrill may not lawfully make payments (for example due to applicable sanctions) are not eligible for rewards.
7.5 You are solely responsible for any taxes or duties arising from a reward in your jurisdiction.
7.6 Nothing on this page constitutes an offer or creates any obligation of Astrill to pay a reward. Participation in the program does not create any employment, agency or other contractual relationship between you and Astrill.
8.1 You must not disclose a reported vulnerability, in whole or in part, to any third party or to the public — including blog posts, social media, conference talks and vulnerability databases — without Astrill's prior written consent.
8.2 Astrill alone decides if, when and in what level of detail information about a reported vulnerability is published, and whether and how the reporter is credited. Where we do publish, we are happy to credit researchers who wish to be named.
8.3 Any violation of this section forfeits eligibility for a reward and voids the safe harbor in section 6.2.
Last Updated: August 2026
