Set clear legal ground rules for your bug bounty terms

A bug bounty programme can create confusion quickly if the rules do not match your actual systems or the way reports are handled. Researchers may test outside the intended scope, submit claims for rewards you did not mean to offer, or assume they have broader permission than you intended. Poorly matched wording can also create issues around confidential information, ownership of submissions and communications with participants. A tailored document helps set the boundaries in writing and gives your team a clearer basis for running the programme consistently.

Most bug bounty terms deal with who can participate, what assets or environments are in scope, what conduct is prohibited, how vulnerabilities must be reported and whether rewards are available. They can also address response expectations, confidentiality, handling of proof-of-concept material, ownership or licence rights in submitted findings, and limits around access to data or live systems. If your programme touches support or service commitments, those points can also be reflected. The right drafting How you collect, use and disclose information will shape both the drafting and the advice..

The legal wording usually turns on your actual programme design rather than the label "bug bounty". We look at the systems involved, whether testing is public or invite-only, how rewards are decided, what kinds of data may be encountered, and how your internal team receives and triages reports. How you collect, use and disclose information will shape both the drafting and the advice, so a programme involving customer data, production systems or third-party infrastructure may need different wording from a limited sandbox or staged testing environment.

You can start from a template as a reference point, but relying on one without review can leave gaps. Overseas examples often assume different legal settings, different privacy expectations, or a programme structure that does not match your business. They may also be silent on practical issues like reward discretion, ownership of submitted materials, or whether testing on connected services is allowed. This service can either produce a fresh document or review an existing draft and adjust it to fit your New Zealand business, systems and operating model.

Timing depends on how detailed your programme is and how quickly instructions are confirmed. After you engage us, your lawyer will gather the key details about the programme, review any existing wording and then prepare or revise the terms. If there are specific questions around scope, rewards, reporting channels or data exposure, those points are worked through as part of the drafting process. Once the document is settled, you can use it as the legal ruleset for your programme. Ongoing programme management or technical rollout sits outside this service.

Submit an enquiry on this page or click 'Get started'. One of our legal consultants will review it within 1 business day and get in touch to understand what you need.

Your consultant will then email you a fixed-fee quote setting out the cost, scope and timing. If you're happy with it, you can accept the quote and sign our engagement letter online.

Once you've accepted, one of our Australian-qualified lawyers will work with you to complete your project. They'll contact you by email or phone if they need anything.

Sprintlaw works on fixed-fee pricing wherever possible, so you can review the scope and cost before you decide whether to proceed. For the Bug Bounty Terms And Conditions service, pricing starts from $900.00.

After you enquire, a legal consultant will confirm what is included, the expected timing and whether any extra work is needed before you engage us.

We work online, so we can help wherever you are in New Zealand. Our team works remotely, mainly from Australia.

Your work is done by our Australian-qualified lawyers, who hold Australian practising certificates and specialise in business law. None of them are New Zealand lawyers or hold a New Zealand practising certificate.

Sprintlaw NZ Limited is a legal consultancy, not a law firm, and is not regulated by the New Zealand Law Society. We don't act in court or tribunal matters, conveyancing (including leases and business sales) or other reserved areas of work. Communications with Sprintlaw are unlikely to be protected by legal professional privilege. We still keep everything confidential under our engagement letter.