Policy and restrictions
Scope covers selected Container Toolkit and CUDA Toolkit components, emphasizing real privilege-boundary impact. Unreleased Container Toolkit builds, theoretical findings and defects lacking security impact are excluded. Denial-of-service, brute force, social engineering and physical intrusion are excluded. Disclosure requires written consent.
Eligibility and submission status
An Intigriti account is required. Sanctions restrictions apply. Platform terms require adulthood, or age 16 with guardian permission; rewards require first reporting, company validation, identity checks and compliance.
The logged-out page invites account-based submissions but provides no explicit current open/paused label. Acceptance is not inferred from page visibility or activity.
Advertised rewards
Advertised tiers show $150–$5,000, $250–$10,000 and $300–$15,000. Critical and exceptional bands have equal ceilings. Dollar denomination is not explicitly established; normalized values remain null. These are policy figures, not individual awards.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
new CDI-based architecture | Other | Tier 1 |
All Other NVIDIA Container Toolkit Assets | Other | Tier 2 |
libNVVM API | Other | Tier 1 |
Nsight Systems | Other | Tier 1 |
NVIDIA Nsight Developer Tools | Other | Tier 1 |
NVRTC library | Other | Tier 1 |
CUDA Libraries | Other | Tier 2 |
NVCC | Other | Tier 2 |
nvJitLink APIs | Other | Tier 2 |
CUDA Runtime APIsPublished location: http://CUDA Runtime APIs | URL | Tier 3 |
CUDA Driver APIs | Other | Tier 3 |
| Asset | Type | Group / eligibility |
|---|---|---|
| No rows captured. This does not establish that the program has no assets or restrictions. | ||
Review limitations
- The reviewed page does not establish the dollar denomination or a policy-wide revision date.
- The July 1, 2025 date applies only to a category-tier rule, not the entire policy.
- Logged-in submission eligibility and expanded safe-harbor terms were not verified. Live terms prevail; this summary grants no testing permission.
Sources and provenance
- NVIDIA Public Bug Bounty program policy NVIDIA / Intigriti · reviewed 2026-10-02
- Intigriti Researcher Terms & Conditions Intigriti · reviewed 2026-10-02
- Published Intigriti asset table NVIDIA · reviewed 2026-10-03
Record reviewed 2026-10-02. Snapshot 53796974ace8. Open the complete JSON contract.