Terms of service

Bounty Operator reviews the files you give it and argues against your finding before a triager does. It reads text. It runs no uploaded code and contacts no target.

A review is not an audit or certification, and it does not decide scope, duplicates, eligibility or rewards. What you submit is your call.

Free costs nothing. Operator is US$10 per week. The website and the MCP server share one allowance per account. The pricing page shows the two plans side by side.

Both plans accept up to 50 UTF-8 text files per review, 120 KB per file, 240 KB and 20,000 lines in total, with instructions up to 16,000 characters.

A hosted review is one profile run through our server on your key, from the workbench or through the MCP server. A review the provider fails, refuses or cuts off at the start is not counted.

Our server adds the method of a hosted profile to your request and sends both to the provider you chose, under your key. No page, tool or download returns it. Do not use a review to obtain it: an answer that repeats the method is stopped and counts as a review.

One person per account. No bulk automation, resale or limit bypassing. Rate limits apply.

Give the service only material you own or are permitted to review, and permitted to share with the provider you select.

Take live secrets and other people’s personal data out first. The privacy check in the workbench flags what it finds before anything is sent.

Do not use the service to attack a target.

You bring your own API key and pay the provider you select directly. The subscription does not include model usage.

A hosted review sends your files and your key through our server to that provider. Our server adds the review method and stores none of the request or the answer.

A request that fails or times out can still be billed by the provider.

Prompt export of the three core profiles is free on both plans. You run the exported prompt in your own chat app or local model. Every other profile runs as a hosted review.

Operator costs US$10 every week and renews automatically until you cancel. Stripe shows any tax before you pay.

That is US$520 over 52 weeks. No trial period: the Free plan is the trial. Cancel in the billing portal before renewal; access runs to the end of the paid week. Price changes are posted here 14 days ahead and never apply to a week already paid.

If you paid and got no access, or the service was down for a material part of your week, we fix it or refund that charge. Otherwise a started week is not refunded. A refund, chargeback or failed renewal ends paid access. Your statutory consumer rights are unaffected.

For a billing problem, email support@bountyoperator.com with the receipt reference. Leave out card numbers, API keys, recovery codes and private reports.

Accounts use passkeys. There is no password.

Keep your recovery code private. Anyone who has it can sign in. Using it replaces it and signs out every session and connection token.

We suspend accounts used for abuse.

The privacy policy lists what we store. The security page shows how it is protected.

The three core profiles, the free tools, the command-line kit and the MCP server are open source under the MIT licence. Using them needs no subscription. The gauntlet stages and the panel cross-examination run on the hosted service. The method of a hosted profile is not published, and the open-source licence does not cover it. The licence is on the licences page.

We update this page when the terms change. The date at the top is the current version.