Running your program

Your product dashboard shows a unique verification token — a 32-character hex string. You need to make that token available at a specific URL on your site, then click Verify ownership in the dashboard. VibeBounty will fetch the URL and compare the file contents to your token.

Create a plain-text file with your token as the sole contents (no surrounding whitespace, no newline):

vb-verify-a1b2c3d4e5f6...  ← paste your exact token here

Serve it at the exact path below, where yourdomain.com is the root of the website URL you entered for the product:

https://yourdomain.com/.well-known/vibebounty-verification.txt

The file must return HTTP 200 with the token as the body — no redirects, no HTML wrapper. VibeBounty fetches it with the user-agent VibeBounty-Ownership-Check. If your host blocks unknown user-agents, you may need to allowlist it.

Go to your product in the developer dashboard and click Verify ownership. If the check passes, the product moves to verified status and you can enable the public listing.

When a researcher opens your program page, VibeBounty issues them a unique session token (stored in a vb_session cookie and URL query parameter). When they visit your site, a lightweight JavaScript snippet reads that token and sends a silent beacon back to VibeBounty. When they later submit a report, VibeBounty checks whether that token was seen on your domain — if it wasn't, the report is rejected automatically.

Copy the snippet from your product's settings in the developer dashboard — it includes the correct worker URL and your product ID pre-filled. It looks like this:

<script
  src="http://localhost:3000/api/canary/script"
  data-program="[your-product-id]"
  async
></script>

Add this tag to every page of your site that a researcher might visit while testing — ideally your root layout or _document. The script is under 1 KB, loads asynchronously, and does nothing if there is no active VibeBounty session.

The beacon records: the canary token, the current page URL, the referrer, and the browser user-agent. No personal data beyond what the researcher's browser naturally sends is transmitted. The data is only used to verify that the session token was seen on your domain.

In your product settings, toggle Require canary proof. When this is on, any report submitted without a verified canary hit is automatically rejected before it reaches your inbox. This is the strongest protection against fabricated reports — we recommend enabling it for all production programs.

In your developer dashboard, each product shows a Canary last seen timestamp. If you visit your own site with an active VibeBounty session, the timestamp will update within a few seconds. If it stays empty, check that the script tag is present and that HTTPS is enabled on your site.

VibeBounty selects the reproduction mode based on the response indicator type:

Researchers must select an indicator type when submitting. This is what the reproducer uses to decide whether the report is valid:

HTTP-mode requests are sent with the user-agent:

VibeBounty-Reproducer/1.0 (+https://vibebounty.dev/bot)

You may see this in your access logs after a report is submitted. Do not block this user-agent — doing so will cause all reports against your program to fail reproduction and be auto-rejected.

Open reports with no developer action are automatically closed after 14 days of inactivity. The close reason is auto_closed_stale and the researcher is not penalised. To prevent auto-close, add a comment or change the status before the deadline.

Failed or errored reproductions are automatically retried. If all attempts fail, the report is marked failed and auto-rejected. Transient network errors consume an attempt but do not immediately mark the report as failed.

In your product settings, enter a login URL, username, and password for a dedicated test account on your site. Credentials are stored encrypted and are only accessed by the automated reproducer — they are never visible to researchers.

Credentials apply to browser-mode reproductions (dom_element, network_request indicator types). If no credentials are provided, the reproducer tests the target URL directly without authentication.

When you accept a report, VibeBounty immediately creates a payout record and initiates a Stripe transfer to the researcher's connected Stripe account. The transfer typically settles within 1–2 business days depending on the researcher's bank.

You need sufficient balance in your Stripe account to cover the transfer. If the transfer fails, the payout will show as failed in your dashboard — you can retry it manually or contact the researcher to sort out their Stripe connection.

Rejected reports require a reviewer note explaining why. Valid rejection reasons:

Include a reviewer note explaining your reasoning. The note is visible to the researcher.

Researchers must connect a Stripe account before they can receive a payout. If you accept a report but the researcher has no connected account, the payout will be held until they connect one. You won't be charged until the transfer is issued.