Find a flaw. Get rewarded and credited.
Anyone can join and report at once. Rewards are set per report and paid once the fix ships.
- NewYou report it, with steps and proof.
- TriagingWe reproduce it.
- AcceptedWe set the grade.
- FixedThe fix ships.
- PaidYour reward, and your points.
What a finding earns.
We set each reward on the severity we assess, the impact, the proof and how easy it is to exploit.
- A cash rewardSet per report. Paid by UPI in India or bank transfer to any country.
- Hall of fame pointsYour name, your findings and their dates, ranked by points.
- A certificateWith an ID anyone can check at blumvo.com/verify.
- A LinkedIn endorsementFor critical findings.
What counts.
In scope
- Authentication bypasses and session hijacking
- Privilege escalation, such as a student reaching a staff screen
- Breaking out of the code execution sandbox
- Proctoring and anti-cheat bypasses on the web, desktop and Android apps
- IDORs that expose other users' answers or personal data
Out of scope
- Denial of service, including DDoS
- Social engineering of our staff, faculty or students
- Theoretical issues with no working exploit
- Missing security headers, SPF or DMARC records
No reward
- A duplicate. The first report wins.
- An issue we are already fixing.
- A client-side check alone, such as hidden UI or a DevTools check, unless it reaches the backend.
- Scanner output with no manual proof.
- A second report of the same root cause.
Keep real students safe.
Real students sit real tests on Blumvo. When you report, you agree to these rules.
- 1Keep every detail confidential until we fix the issue.
- 2Go no further than you need to prove the issue.
- 3Delete any personal data you reach as soon as you have reported it. Never keep, share or use it.
- 4Give us reasonable time to fix the issue before you disclose it.
- 5Take down any public disclosure that puts Blumvo or its users at risk. A reward depends on it.
Safe harbour
We treat security research done in good faith under this policy as authorised. We will not take or support legal action against you for it.
If someone else takes legal action against you for work that followed this policy, we will say that your testing was authorised.
Good faith means staying in scope and touching only the minimum data needed to show a finding. It means never degrading the service for real users. It also means giving us reasonable time to fix the issue before any disclosure.
This authorisation does not cover out-of-scope activity, such as denial of service, social engineering or reading real student data. It does not cover anything that breaks the law, including the Information Technology Act, 2000.
Ask for a sandbox college.
A private college on the real Blumvo, filled with synthetic data, for 14 days. Findings there are graded and paid the same way.
- 1JoinSign up for Security research with your email.
- 2Show a recordOne accepted finding, or a public profile we can check: HackerOne, Bugcrowd, Intigriti, GitHub advisories or a write-up.
- 3AskTurn on two-step sign-in, open Sandbox, say what you plan to test and who you work for.
- 4We reviewYou see Under review, then Approved or Declined.
Before you ask, and the six sandbox rules
- A sandbox is not offered to anyone who works for, consults for or owns an edtech, placement or assessment company. You can still report what you find in your own account or on the public pages.
- Under 18, you can join and report now. A sandbox and any payout wait for a parent or guardian's consent.
- You hold one sandbox or one request at a time.
The sandbox rules
- Test only inside your sandbox college and the canary college.
- If you can see or change anything that belongs to any other college, stop, do not look further, and report it. We grade that Critical. Exploring real data after that point voids the report.
- No load testing and no volumetric scanning. Automated tools at a low rate are fine.
- The logins are yours alone. Do not share them.
- Everything in the sandbox is deleted when it ends, including files you upload.
- Findings made in the sandbox are real findings, graded and paid the same way.
Credited by name.
See the hall of fame- 1Pratham Reet60 points · 5 findingsPrivilege-escalation path from the student role, Jun 2026
- 2Bhavya Saini55 points · 4 findingsAnti-cheat telemetry bypass, May 2026
- 3Nishant Lungare40 points · 2 findingsOver-broad access to practice answer keys, Jun 2026
FAQ
Anyone. Already on Blumvo as a student or at a college? Sign in, then go to Settings, Security research and select Join. Your college account does not change. College staff are credited, not paid.
File it in Security research. Each report gets its own thread, so you see its status, our grade and your reward in one place.
By UPI in India or by bank transfer to any country, once the fix ships.
Yes. Anyone can check a certificate's ID at blumvo.com/verify.
Open to everyone.
Sign up with your email and report at once. Your reports, our replies and your points stay in one place.