[Important Security Notice] Fake Qfinder Pro Websites Detected. Learn more >
Search

Security Bounty Program

QNAP is committed to cybersecurity and works together with partners and the security community to ensure the security of QNAP products, giving users greater peace of mind and safeguarding product systems and data. To thank researchers who discover potential security issues and help improve customer security, QNAP offers rewards through its Security Bounty Program.

Acknowledgments

Program Scope

The Bounty Program only accepts reports of security vulnerabilities related to QNAP products and online services. Any security report outside the scope of this Program is not accepted under this Program and is not eligible for a reward. This Program does not accept or reward security vulnerabilities found in third-party software (e.g., third-party QPKGs). If you discover a security issue in such software, please contact and notify the relevant vendor or developer directly. For other security issues that fall outside the reward scope of this Program but relate to QNAP products or services, please refer to the Coordinated Vulnerability Disclosure Policy for how to report them.

  • Operating Systems

    Bounty up to US$20,000

    Operating systems developed by QNAP — QTS, QuTS hero, and QuTScloud — are all covered by this Program.

  • Applications

    Bounty up to US$10,000

    Applications officially developed by QNAP.

  • Cloud Services

    Bounty up to US$5,000

    Cloud services officially provided by QNAP.

How to Report Security Issues and Vulnerabilities?

Please encrypt your email using the PGP public key below and send it to security@qnap.com. QNAP PSIRT will proactively contact the researcher to confirm the submission.

Recommended Vulnerability Report Format

  • Operating Systems

  • Applications

  • Cloud Services

PGP encryption key

Report Vulnerability

Eligibility Criteria

  • You must be the first researcher to report the vulnerability.

  • You have not publicly disclosed the vulnerability.

  • The vulnerability you report is confirmed by QNAP staff to be verifiable, reproducible, and eligible for a reward.

  • You fully agree to and comply with the Bounty Program rules.

  • If you accessed non-public data of QNAP or its users during your research, you have deleted such data in accordance with the Testing Conduct and Data Handling Rules and provided a written deletion statement within the required period.

Reward amounts may be adjusted depending on the following:

Bonus factors

  • Follow the recommended vulnerability report format: Please provide necessary and sufficient vulnerability information. Recommended formats: Operating System format example, Application format example, Cloud Service format example.

  • Reproduction steps: Clear and detailed steps to reproduce.

  • Issue description: A well-organized vulnerability report with clearly structured paragraphs.

  • Supplementary information: Items recommended in the vulnerability report format examples, or other useful information such as test code, scripts, or other detailed explanations.

  • Provide the complete raw exploit payload in text form: If the payload is provided only as an image, the QNAP PSIRT team cannot guarantee it can be reproduced correctly. If a valid attack cannot be reproduced, the vulnerability determination may be invalidated.

Adjustment factors

  • Issue severity and review order: QNAP PSIRT prioritizes verification and remediation based on issue severity, giving priority to issues with a significant impact on user data and systems. Issue severity is determined by the Bounty Committee with reference to the CVSS v3.1 score, combined with real-world exploitability and scope of impact. Issues rated as low severity will be reviewed after high-severity issues. All confirmed issues affecting products still within their support period, regardless of severity, will be included in QNAP's remediation schedule.

  • Reward amount by severity: Rewards are granted according to the severity tier assigned to the issue. Rewards for issues rated as low severity will be adjusted accordingly and will be lower than those for high-severity issues in the same scope. The amount published for each scope is the maximum for that scope, not a guaranteed amount for each case.

  • If an issue is rated as low severity and is merely a security improvement suggestion that causes no actual harm (e.g., configuration recommendations, disclosure of version or path information, best-practice reminders), and verification cannot demonstrate that it can actually be exploited to cause harm, no bounty will be awarded. However, it is still considered a valid issue, and we will still include you in our public acknowledgments. This differs from "not eligible for a reward" (not accepted and not acknowledged); the main distinction between the two is whether verifiable actual execution results are provided. For specific cases that are not eligible for a reward, see the "Notes" for each scope.

  • Duplicate and same-origin issues: If multiple reports are confirmed to stem from the same root cause or the same code path, or can be resolved by the same fix, QNAP PSIRT may evaluate them as a single case. The reward for a merged case is capped at a single amount for the tier to which the case belongs and does not accumulate by the number of reports; the reward goes to the earliest complete report received.

  • Subsequent reports of the same issue type: Subsequent reports of an issue type that QNAP has already accepted or fixed (including issues of the same type in different interfaces, parameters, or modules) may be treated as variants of the existing case. Such reports will still be individually recognized as valid issues and individually assigned CVE IDs, while rewards will be granted for the issue class as a whole: the 1st through 10th reports in the same issue class receive the full amount for their tier; from the 11th report onward, 10% of the tier amount is granted. The count is cumulative across all reporters, with no separate counting period. The "same issue class" is determined by the same CWE classification together with the same functional component or the same code pattern. QNAP PSIRT will inform you of the variant determination and the current cumulative sequence number for that issue class in the vulnerability confirmation email. If you disagree, you may write to us within 14 calendar days of receiving the email.

  • Report completeness and reproducibility: For reports where the reporter has not independently re-verified the issue, or has only provided raw tool output without explaining the actual impact and how to reproduce it, QNAP PSIRT may ask the reporter to provide additional information. Until the additional information is provided, the case will be reviewed after cases with complete information.

  • Actual security impact: Rewards will be adjusted accordingly for issues that are purely theoretical, require highly unusual preconditions, or cannot be shown to have a substantive impact on user data and systems.

Acknowledgments

Thank you to all researchers for your expertise and dedication.

FAQ

The reward mechanism and bounty amount are determined by the Bounty Review Team, composed of QNAP PSIRT members, taking into account the following factors: the complexity of successfully exploiting the vulnerability, and the threat posed by the vulnerability, including the percentage of affected users and systems.

Yes. If a video makes it easier to understand how the vulnerability is exploited, the Bounty Committee may increase the reward accordingly. Please note that written documentation is required (e.g., a PoC document and a full explanation), as this helps manage the vulnerability disclosure process.

At a minimum, a vulnerability report must include: the name of the affected product and its version and build number, or the URL of the cloud service; a summary of the vulnerability's potential threat; and detailed, clear steps to reproduce, optionally accompanied by a video to reproduce the vulnerability.

Please encrypt your report using the PGP public key provided by QNAP and send it to security@qnap.com. Once the email is received, the system will automatically reply with a technical ticket number, which the researcher can use to check the review progress.

The QNAP PSIRT team will proactively contact the researcher to confirm whether the submission is complete. For cases with complete information that are initially assessed as high severity, the researcher will, in principle, receive a QNAP PSIRT vulnerability confirmation email within one week after the information is confirmed complete, including the CVE ID assigned to the report.

A bounty proposal will be sent by email four weeks after the date the vulnerability confirmation email is sent. If the researcher accepts the proposal, QNAP expects to complete payment within twelve weeks of receiving the confirmation reply.

During verification, QNAP PSIRT analyzes the root cause of each case. If multiple reports are confirmed to stem from the same root cause, the same code path, or the same design pattern, they will be handled as a single case, and the reward goes to the earliest complete report received; if a subsequent report provides additional security impact information, we will still take it into account. For issues of the same type that each require an independent fix, we will recognize them individually and assign separate CVE IDs; rewards will be granted for the issue class as a whole, with the 1st through 10th reports receiving the full tier amount and, from the 11th report onward, 10% of the tier amount. The count is cumulative across all reporters.

Yes. QNAP respects all research methods; what we care about is the quality of the report itself. Regardless of the tools used, please re-verify the issue yourself before submitting, and include reproduction steps and the actual security impact in the report. For reports that only include raw tool output, have not been verified, or do not explain the impact, we may need to ask you for more information, and they will be reviewed after cases with complete information. Reports assessed as having no actual security impact will not be eligible for a reward.

QNAP prioritizes resources for issues with a significant impact on user data and systems. Therefore, low-severity issues are verified and responded to after high-severity issues, and rewards are adjusted according to their severity tier. This does not affect how we handle the issue — all confirmed issues are included in the remediation schedule. If you believe the rating does not reflect the actual impact, please email security@qnap.com with information that may raise the impact assessment, such as lower privilege prerequisites, a broader range of affected versions, or an explanation of how the issue can be chained with other issues to form a complete attack chain.

If your issue is a security improvement suggestion that causes no actual harm, we will still include you in our public acknowledgments, but no bounty will be awarded.

Please stop any further access immediately. In the impact description of your report, state the names of the tables or endpoints involved, the field names, and the number of records, and if necessary attach a masked sample. There is no need to — and please do not — attach raw data files.

After submitting your report, please delete all copies within 7 calendar days and email a signed written deletion statement stating the scope of deleted data, the date and time of deletion, and the deletion method, and confirming that all storage locations listed in the Testing Conduct and Data Handling Rules have been covered. This statement is a prerequisite for receiving a reward.

The statement may use the name or research alias you used when reporting; no other proof of identity is required. If your organization's policies prevent you from signing in your personal name, a contact person from your organization may issue it on your behalf, or you may reply by email confirming each item. If the statement is not provided within the deadline, we will first send a reminder by email and suspend the reward evaluation for the case.

Accurately describing the extent of your access will not affect your eligibility for a reward; on the contrary, it helps QNAP accurately assess the impact and take necessary measures.

Security Advisory Subscription

We recommend subscribing to QNAP Security Advisories to get first-hand security information!

Subscribe nowHow to read security advisories

Last updated: 2026/08/31. The terms of this Program may be adjusted from time to time; the latest version published on this page shall prevail.

Choose specification

      Show more Less
      Choose Your Country or Region
      open menu
      back to top