Programme

Bug bounty

Rex publishes numbers people spend money on. A wrong figure is a defect, and so is a page that leaks, breaks or misleads.

Planned — not open yet

The terms below are what Rex commits to when the programme opens. Nothing here accepts a submission today, and no page pretends otherwise.

How it would work

STEP 1
Data defects
A value that does not match the firm's published page, a stale figure presented as current, or a comparison that puts two incompatible units side by side.
STEP 2
Product defects
A broken journey, an inaccessible control, a page that fails on a phone, or a state that renders as permission when it should read unknown.
STEP 3
Security reports
Reported privately and fixed before disclosure. Rex holds no accounts and no payment data, which limits the surface but does not eliminate it.

Written before the programme exists, so they cannot be quietly softened once money is involved.

Report privately first. Do not test against anything that is not yours.
Data defects are the highest-value category here, because they are the ones that cost a reader money.
No automated scanning of the firms Rex cites; they are third parties and not part of any scope.
The intake channel opens with the programme.

What counts as a data defect?: Any published value that disagrees with the firm's own current page, or any figure presented with more confidence than its evidence supports.
Is there a reward today?: No. The programme is planned, not open, and this page says so rather than implying otherwise.