Bug bounty: donations with the Charitips API

A SaaS pays its bug bounty in donations: 5 € to 5 000 € by severity. The researcher submits a report and picks the charity; the security team sets the amount at validation.

Who paysYour company
Starts withA customer action
Tax receiptIn your company's name

Needs API access on a validated account. Plans

One variant of A reward validated later · Software and apps

5 € to 5 000 € by severity, set at validation

See every variant

Device

Charities shown as

Outline widget

security.your-saas.example

Step by step

Click through the site. Each step shows what your customer does, what your server sends and what Charitips answers.

1When the report is sent
To come
Your customer does…
Clicks “Send the report”.
Your server sends…
Creates a 500 € donation for report #412 on the campaign “Your security portal”.
POSTcreate-donation
Charitips answers…
Charitips records the donation and returns its id: it waits for your customer to pick a charity.
Charitips will then tell your server the donation was created.
2When the charity is chosen
To come
Your customer does…
Clicks “Choose the charity”.
Your server sends…
Assigns that donation to the charity your customer picks.
POSTclaim-donation
Charitips answers…
The donation now goes to the charity your customer picks.
Charitips will then tell your server the donation was updated.
3When the vulnerability is reviewed
To come
Your customer does…
Clicks “Validate: 500 €”.
Your server sends…
Calls validate donation.
POSTvalidate-donation
Charitips answers…
Charitips answers the call.
Charitips will then tell your server the donation was updated.

How to read this demo: the site shows what your customer does, and the panel what your server sends and what Charitips answers, step by step.

Build spec

The site is made up and nothing is sent. The endpoints, fields and webhook events are the real ones, and so are the charities.

How it works

The screens of the demo in order, with the calls your server makes at each one. Its build spec

Callscreate-charities-selection create-campaign activate-campaign create-donation claim-donation validate-donation

Webhooksdonation_createdonation_update

Once, before the first customer
- POST /v1/charities-selectionsCreate a charities selection: once: the charities you offer, from the catalog
- POST /v1/campaignsCreate a campaign: once: the campaign the donations go to
- POST /v1/campaigns/{campaignId}/activateActivate a campaign: once: the campaign starts taking donations
01
When the report is sent
Button: Send the report
Your server calls:
- POST /v1/donationsCreate a donation: from your server, when it happens; amount in cents
Charitips then sends the donation_create webhook to your endpoint.
02
When the charity is chosen
The customer picks a charity from your selection. Button: Choose the charity
Your server calls:
- POST /v1/donations/{donationId}/claimClaim a donation: donationId from the create-donation response
Charitips then sends the donation_update webhook to your endpoint.
03
When the vulnerability is reviewed
Button: Validate: 500 €
Your server calls:
- POST /v1/donations/{donationId}/validateValidate a donation: once your team has checked it; donationId from the create-donation response
Charitips then sends the donation_update webhook to your endpoint.

Other ways to run it

The same calls in other sectors and products. Each card opens its own page, with its demo.

Professional servicesEmployee referral bonusA company adds 50 € for a charity on top of each employee referral bonus. The employee picks the charity when the hire is made; HR validates after the probation period.50 € once the hire passes the trial periodTry the demoA reward validated later: Employee referral bonus
Health and sportBottles returned by postA beauty brand gives 0,50 € for each empty bottle sent back with a prepaid label. The customer declares the parcel and picks the charity; the workshop validates each bottle.0,50 € per bottle received and checkedTry the demoA reward validated later: Bottles returned by post
Banking and insuranceHealth goal validatedA health insurer gives 20 € when a member declares a health goal with proof. The member picks the charity when declaring; the insurer checks the proof and validates the donation.20 € per goal validated by a doctorTry the demoA reward validated later: Health goal validated
Software and appsAppointment keptA medical practice gives 0,20 € when a patient confirms a reminder, 50 % more if they arrive on time. The patient picks the charity when confirming; reception validates arrival.0,20 € per confirmed reminder, +50 % if on timeTry the demoA reward validated later: Appointment kept
Professional servicesReal-world mission validatedA field missions app turns a mission's 5 € reward into a donation. The worker completes the mission and picks the charity; the ops team validates the report, the app pays.5 € per mission validated by the ops teamTry the demoA reward validated later: Real-world mission validated

One variant of A reward validated later · Software and apps

How it works

Once, before the first customer

When the report is sent

When the charity is chosen

When the vulnerability is reviewed

Other ways to run it