Bug Bounty Programme

Submit your finding to TATA Play using our link Bug Bounty portal, along with your contact details and all mandatory information fields.

• You will receive an email confirming that we have received your submission.

• Our security team will review the submission, including reproducing the vulnerability and assessing the severity and security impact. The review time may vary depending on the complexity and completeness of your submission, but typically takes 1 week.

• After your submission has been reproduced and assessed, the bounty team will review your submission for bounty award eligibility. If your submission is eligible for a bounty award, the bounty team will contact you.

Please see the Eligibility section of the TATA Play’s Bug Bounty programme details here

• The products and services in scope for bounty awards are published on our Bounty Program’s page.

• TATA Play retains sole discretion in determining which submissions are qualified.

• If we receive multiple bug reports for the same issue from different parties, the bounty will be awarded to the first eligible submission. The other submission will be considered duplicate, and not eligible for bounty awards.

• If we are aware of the issue internally but have not yet released a fix, the first eligible external submission is still eligible for award.