With bug bounties becoming an established industry-wide best practice, TTS desires to establish one of its own. The TTS vulnerability disclosure policy that was released in November 2016 outlines how researchers can report system vulnerabilities, while keeping personal and financial information safe. TTS wishes to incentivize security researchers and other interested users to report security issues directly to the system owner through the use of financial rewards - or, a bug bounty

Vendors shall submit a quotation in accordance with the instructions specified in the RFQ letter and the terms and conditions of this quotation listed on the GitHub repository at https://github.com/18F/tts-buy-bug-bounty. Please ensure that a response includes all requested information and that your technical response clearly demonstrates the company’s capability to perform the objectives and requirements specified in the PWS. The Government intends to award based on initial quotations. Therefore, it is critical that you are fully responsive to the solicitation and submit your best quotation initially.

Questions or comments regarding this RFQ shall be submitted as issues within the GitHub repository at https://github.com/18F/tts-buy-bug-bounty no later than February 21, 2017 by 4:00 pm EST, to allow the Government sufficient time to respond. All questions and comments will be publicly available. Please subscribe to the repository if your firm would like updates about changes and comments. Questions or comments received after the required deadline will not be answered. Any changes to this RFQ or attachments will be posted as an amendment on GitHub and GSA FedBizOps (“FBO”).

All quotations must be received electronically to [email protected], by the official closing date and time identified above. Late quotations will not be considered for award.