Rain Bug Bounty

Rain is a stablecoin payments platform for the tokenized future. Through a single API, Rain helps companies launch stablecoin-powered cards, manage digital dollar accounts, and move money across borders on modern settlement rails.

Severity Definitions

Severity is determined using the Cantina Bug Bounty Severity Classification Framework, applied to Rain's websites and APIs as follows. Findings are rated by the impact actually demonstrated against Rain's production systems, not by vulnerability type. Only Critical and High findings are eligible for a reward.

• Critical: Unauthorized movement or theft of user or partner funds; mass exposure of KYC data, card data (PAN) or other personally identifiable information across users or partners; remote code execution or compromise of production infrastructure or secrets that enables any of the above.
• High: Exposure of KYC, card or other personal data affecting multiple users or partners at a smaller scale; reading or acting on another partner's sensitive data through the partner dashboard or partner API; takeover of accounts that control other users' funds or data; loss of Rain's own funds, such as fees or treasury funds.
• Medium: Non-sensitive data disclosure, open redirects, or reflected HTML injection. Not eligible for a reward.
• Low: Issues whose impact is limited to a single account, or whose impact is theoretical. Not eligible for a reward.

Severity Caps

The following caps apply to every finding, regardless of vulnerability type:

• No user or partner impact: A finding on any in-scope website, API or subdomain that does not demonstrably expose user or partner data, or cause a loss of funds, is rated at most Medium and is not eligible for a reward. An authorization bypass, injection, XSS or account takeover is rated by what it lets an attacker do, not by its type.
• Rain's own funds: A finding whose impact is limited to loss of Rain's own funds, such as fees or treasury funds, is rated at most High.
• Third-party code: A vulnerability that originates in a third-party library, dependency or service may be assigned a lower severity at Rain's discretion, even when it affects Rain's infrastructure. The finding must demonstrate impact on Rain's in-scope systems. A vulnerability in third-party code with no demonstrated impact on Rain is not eligible for a reward.

Prohibited Actions

• Testing against Rain's production websites and APIs is allowed, but must be non-destructive, targeted, and limited to accounts you already control. Do not perform load testing, spam, or state-changing actions that affect other users, partners, or production services.
• Do not register new accounts, request access, or attempt to onboard as a Rain partner. Rain does not approve or KYC researchers and does not provide test accounts or credentials.
• Researchers may not exploit a vulnerability beyond what is necessary to demonstrate impact, and must not access, modify, or exfiltrate real user or partner funds or data.
• No public disclosure of a finding before it has been resolved and disclosure has been coordinated with Rain and Cantina.
• Individuals who contributed to Rain's in-scope systems, or who are involved in a prior or ongoing security review of them, may not submit findings related to that work.
• All communication about this program must happen on the Cantina platform. Do not contact Rain or its employees through any other channel (email, social media, Discord, Telegram, or otherwise) for any reason, including to discuss a submitted finding or to ask for access. Violations may result in findings being rejected with no reward and a ban from the Cantina platform.

Eligibility

• Open to all Cantina researchers meeting Cantina's standard eligibility requirements.
• Participants must not be residents of, or located in, any OFAC-sanctioned jurisdiction, nor appear on any OFAC sanctions list.
• Rain employees, contractors, and their immediate family members are not eligible to participate.

Other Terms

• Duplicate findings, and issues already known to Rain internally at the time of submission, are not eligible for a reward.
• Payment and disclosure timelines follow Cantina's standard bug bounty process.
• By submitting a finding, researchers agree to Cantina's Terms of Service and this program's rules.