Service Level Agreements (SLAs) & Notifications

Service Level Agreements (SLAs) keep both our projects and whitehats accountable to proper response times and expectations of resolution.

When you were onboarded with Immunefi, you may have received a document going over the expectations of having a bug bounty program with us, which includes expected response times, as well as expectations for rewarding and communicating with whitehats.

We expect projects to follow the agreed upon documents for the benefit of all involved. 

Note: Whitehats generally provide information within 24 hours from inquiry, as they are incentivized to get bug reports closed right away. 

Standard Bug Bounty Program Operation SLA Table

The below SLAs designate time from escalation of the original submission and the required time frame during which you should communicate.

 

Severity Level	Report Acknowledged	Resolution on Report	Immunefi 10% fee payment	Total SLA by Severity Level
Critical	48 hours	14 days from escalation	7 days from date of Immunefi's request for payment	21 days
High	96 hours			21 days
Medium		7 days from escalation		14 days
Low				14 days

Please note that resolving a bug report is not defined as fixing the actual bug, as this is not up to Immunefi nor the Whitehat. A bug report is considered resolved when the whitehat is rewarded and Immunefi fee is paid.

If you are not able to resolve a bug report within the expected time frame, you need to communicate this before it goes beyond that time frame. 

Whitehats expect projects to reply within these time frames and can request mediation from Immunefi if they don’t receive a response in accordance with these SLAs.

SLA Email Notifications

Once a bug report is escalated to you, you will begin to receive a series of email notifications advising you of the deadline to SLA. Below are some examples, for which you should take action (see

Quick Actions for more detail).

​

 

High or Critical Vulnerability Received:

Example of notification sent whenever a high or critical bug report is received.

 

 

SLA Approaching

This is a reminder to take action and for you to know how much time is left on the SLA. If you are unresponsive, this notification will continue to be sent at different intervals (i.e., 48h / 24h / 12h before SLA breakage).

 

 

Time to decide a verdict

This notification is sent when a report is escalated but no decision is made on either confirming it and moving towards payment or closing it for being invalid. By clicking on 'Submit verdict decision', you will be directed to the Quick Actions panel to make a decision on next steps.

 

 

 

Confirmed status

This notification will be sent once you have confirmed a vulnerability with the whitehat and updated the status accordingly, but have not yet paid them out. Please note that resolving a report requires you to pay out the whitehat (and Immunefi) and update the status to 'Paid'. (See Bug Report Statuses and Quick Actions for more detail.)