How it works

Clear scope. Real findings. Kwacha bounties.

Mibocorp is a Malawi-first bug bounty platform. Organisations publish what may be tested; researchers test it and report; the organisation triages and pays.

For organisations

Register your organisation. A company account creates your organisation profile and a private dashboard.
Create a program. Give it a name, description, policy, response target and a bounty range in MWK.
Add scope. List exact domains, wildcards, URLs, IPs, CIDR ranges and mobile app IDs. Add out-of-scope assets too — those always win.
Publish. Once at least one in-scope asset exists, publish the program. Researchers can then see it in the directory.
Triage. Move reports through submitted, triaged, needs info, accepted, duplicate, rejected and resolved. Add notes for the researcher or internal notes for your team.
Pay. Award a bounty on an accepted report, then record the mobile money or bank reference once the transfer clears.

For researchers

Create a profile. Choose a handle, add your district and skills. Your handle appears on the leaderboard.
Add a payout account. Airtel Money, TNM Mpamba or a Malawian bank account. Numbers are encrypted at rest and shown only by their last four digits.
Pick a program. Read its description, policy and every scope row before you test.
Submit a report. Include the exact target, severity, an optional CVSS 3.1 vector, a summary, reproduction steps and impact. The platform checks your target against the published scope.
Work with triage. Answer questions in the report thread. Internal notes are visible only to the organisation.
Get paid. When a report is accepted, the organisation awards a bounty and marks it paid with a transaction reference.

Safe harbour

The rules that protect good-faith research

Do

Test only assets listed as in scope for that program.
Stop as soon as you have proof. Use the minimum access needed.
Report privately through Mibocorp and give the organisation time to fix it.
Respect the program's disclosure window before publishing anything.

Do not

Test out-of-scope assets, even if a wildcard appears to cover them.
Access, copy or retain real customer data, funds or credentials.
Run denial-of-service, spam, social engineering or physical attacks.
Use automated scanners in a way that degrades a live service.

Authorization comes from scope. A program's published scope and policy are the permission you rely on. If something is not listed, treat it as out of scope and ask first. Mibocorp can suspend accounts that break these rules.

Money

How bounties work in Malawi

Kwacha first

Programs set minimum and maximum bounties in MWK, so there is no exchange-rate surprise when a finding is accepted.

Mobile money ready

Airtel Money and TNM Mpamba accounts are supported alongside bank transfers, with PayChangu as a settlement option.

Every payout recorded

Each bounty gets a reference, a status and a transaction reference, so researchers and finance teams can reconcile.

Ready to start?

Join as a researcher, or register your organisation and publish your first scope.

Join as a researcher Run a program