Program status

Ultra’s public bug bounty program is currently paused. Effective 25 August 2026 at 14:34 UTC, Ultra is not accepting new submissions for monetary rewards. Reports submitted after this time are not eligible for a monetary reward. No restart date has been set.

Ultra continues to receive reports of suspected serious security vulnerabilities affecting Ultra-owned products and services at security@ultra.io. This is a security reporting channel, not a paid bounty program. While the program is paused, Ultra cannot promise a reward, response time, remediation timeline, or public recognition.