The platform you're targeting must have an active bug bounty program with the asset class in scope at submission time.

SoGood's program is open — no invite required. For invite-only programs, have your program acknowledgment ready.

By submitting, you confirm use for authorized security research only and agree to follow the platform's disclosure policy.

The signed zip is delivered to the email you provide. The manifest.json inside records your handle, scope, and the SHA-256 hash.