How NourySafe works
A step-by-step guide for penetration testers (researchers) and companies — from creating an account to submitting reports or running a reward program.
I am a penetration tester
Find programs, submit vulnerability reports and earn rewards.
Start readingI am a company
Publish a program, receive reports and get your assets fixed.
Start readingStart here: create your account
The same for both roles — it takes a few minutes.
-
1
1. Sign up
Open the register page and enter your name, email and a strong password. Choose your role: researcher (tester) or company.
-
2
2. Verify your email
We email you a 6-digit code. Enter it on the verification page. The code expires in 10 minutes; you can resend it if needed.
-
3
3. Log in
Once verified, log in with your email and password. You land on your role-specific dashboard.
-
4
4. Verify your identity (KYC)
From the menu, open Identity verification and upload one document — a national ID card for researchers, a commercial registry for companies. Files are encrypted and visible to platform admins only.
-
5
5. Secure your account
In Account settings you can change your password, link Telegram for notifications, and review your recent activity and known networks.
For penetration testers (researchers)
Find a program, test legally, and get paid for accepted reports.
-
1
Browse reward programs
Open Available programs to see every published program. Each one lists what is in scope, what is out of scope, the severity tiers and the reward for each.
-
2
Open a program
Click a program to read its full scope and rules. Only test assets that are explicitly in scope, and always respect the ethical testing rules.
-
3
Find a vulnerability
Use your own methodology to find a real security problem, such as an injection vulnerability, an access control flaw, or a leak of sensitive data.
-
4
Submit a report
On the program page choose Submit a report. Provide a clear title, the vulnerability type, a description, step-by-step reproduction steps, the impact, a suggested severity and an optional proof of concept.
-
5
Attach evidence
Add screenshots, request/response dumps or a short video. Files are encrypted at rest. Never include third-party personal data.
-
6
Wait for triage
The NourySafe team reviews every report for quality and duplication. A duplicate or out-of-scope report is closed with a reason; a valid one moves forward.
-
7
Track and collaborate
Follow your report's status under My reports and discuss it in the private workspace with the triage team and, once forwarded, the company.
-
8
Get rewarded
When a report is accepted and the company marks it fixed, the reward is added to your Wallet. You can request a payout (CCP, BaridiMob, EDAHABIA, bank transfer) or convert it into platform credit.
-
9
Build reputation
Accepted reports improve your reputation and can earn certificates and testimonials from companies. Your profile can appear in the Hall of Fame.
Report statuses you will see
Submitted and Under review mean triage is in progress. Accepted and Forwarded to company mean your report is valid. Fixed means the company resolved it and your reward is released. Rejected and Duplicate close the report.
For companies
Publish a reward program and turn security reports into fixes.
-
1
Create your reward program
Open My programs then Create. Give the program a title, describe the in-scope assets, the out-of-scope items, the reward range and any specific rules.
-
2
Set severity rewards
Choose the amount you pay for each severity tier (critical, high, medium, low). This tells researchers what a valid finding is worth before they start testing.
-
3
Submit for approval
The platform administration reviews every program before it goes public. You are notified once it is approved and published.
-
4
Receive reports
Valid reports reach you under Received reports after the NourySafe team verifies them. Each report shows the vulnerability, its impact and the reproduction steps.
-
5
Discuss in the workspace
Use the private report workspace to ask the researcher questions and share additional context while you verify the issue.
-
6
Fix and mark resolved
Apply the fix on your side, then mark the report as Fixed in the workspace. This releases the reward to the researcher.
-
7
Run your own scans
Independently of programs, you can run vulnerability scans on your approved assets from My scans and export a PDF report for your team.
-
8
Review payments
Track the rewards paid to researchers and your transaction history under Payments, and manage vulnerability pricing from Vulnerability pricing.
Frequently asked questions
Is testing without a program allowed?
No. Only test assets that are in scope of a published program you are allowed to work on, and always follow the ethical testing rules shown on the program page.
How long does verification take?
The NourySafe team reviews identity documents and submitted programs as quickly as possible. You receive an in-app notification and an email once a decision is made.
When do I get paid for a report?
A reward is released once the report is accepted and the company marks it fixed. The amount then appears in your Wallet, ready for withdrawal or conversion to credit.
What makes a good report?
A clear title, the exact vulnerability type, minimal and reliable reproduction steps, the real-world impact, and evidence (screenshots or a proof of concept). Avoid duplicates and never include personal data.
How is a program approved?
After you submit a program, the platform administration reviews its scope, rewards and rules. Approved programs are published and become visible to all researchers.
Can my program be private?
Yes. A program can be public (visible to every researcher) or private (by invitation). Private programs may be limited depending on the VIP option being active.
Ready to get started?
Create your account, or browse the verified testers directory first.