Red team engagements.

ADI runs an in-house red team that takes part in public bug bounty programs.

Why we have a red team

We build automation for real work. Security research is one of the places we show that careful work can be automated: it rewards patience, staying inside the rules, and a report someone else can follow step by step.

We take part only in official bug bounty programs.

Got a report from someone at ADI?

It is legitimate, and it is fine. That is us. Here is what that report was written under.

Scope

We work only within the scope and rules a program publishes — on HackerOne, on Bugcrowd, or in a company's own bounty program. We never test a system that has no program, and we never go outside a program's scope.

What we do

• Report through the program's own channel.
• Give clear steps to reproduce what we found.
• Follow the program's disclosure timeline.

What we never do

• Ask for payment outside the program.
• Threaten to publish.
• Access or keep data beyond what a proof needs.
• Run anything that could degrade a service, denial of service included.

How to check it is us

A real report from ADI reaches you one of two ways: through the bug bounty platform the program runs on, or from security@withadi.dev.

If you are not sure, write to security@withadi.dev and we will confirm or deny that it came from us.

Anyone who says they are from ADI and asks you for money, or who writes from any other address, is not us.