1. Generic Guidelines

Bentley Systems requires that all researchers

• Avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing.
• Perform research only within the scope set out below.
• Use the communication channels defined below to report vulnerability information to us.
• Keep information about any vulnerabilities you have discovered confidential between you and Bentley Systems until it is fixed.

If you follow these guidelines when reporting an issue to us, we commit

• Not to pursue or support any legal action related to your research.
• To work with you to understand and resolve the issue quickly.

2. Code of Conduct and Legal Responsibilities

When conducting vulnerability research according to this policy, we consider this research to be

• Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (or similar state laws), and we will not initiate or support legal action against you for accidental, good-faith violations of this policy.
• Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls.
• Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy.
• Lawful, helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our communication channels defined below before going any further.

3. Scope / Out of Scope

4. Eligible Vulnerabilities / Exclusions

5. How to Report

If you believe you’ve found a security vulnerability in one of our products or platforms, please fill in the form on this page. 

A good practice is to think whether the discovered vulnerability puts at risk:

• Bentley Systems clients’ information.
• Bentley Systems software.
• Bentley Systems reputation.

Make sure to have included the following information:

• Detailed description of the vulnerability containing info such as URL, full HTTP request/response, and type of vulnerability.
• Information necessary to reproduce the issue.
• Proof of concept including practical severity and attack scenario, indication of a potential risk only is hard to evaluate and usually such report is not approved.
  If applicable, a screenshot and/or video of the vulnerability.
• Contact information, name, email, phone number, location. Submissions without this information will not be considered.
• IMPORTANT NOTE. You may only make the initial submission through the form. If you have any questions not mentioned in a form, please e-mail us at security@bentley.com.

6. Rules of Engagement

• DoS is strictly prohibited.
• Any form of credentials brute forcing is strictly prohibited.
• Public disclosure of a reported vulnerability before it has been fixed is prohibited.
• You may not destroy or degrade our performance or violate the privacy or integrity of our users and their data.
• Exploiting vulnerabilities (other than a generic PoC) is strictly prohibited and will be prosecuted according to applicable law.
• If a vulnerability provides unintended access to data, you must
  
  • Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and
  • Cease testing and
  • Submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary
    information.
• Bentley will not respond to extortion or other coercive, criminal acts (e.g. demands for payment up front in exchange for not exploiting a found vulnerability.

7. Public Disclosure

Unless otherwise informed by our team that the vulnerability has been resolved, please withhold public disclosure of the vulnerability for 90 days. Failure to do so will result in legal action.

8. Duplicates

• Only the first researcher to report an issue will be entitled for a reward.
  The reports of the same issue in different environments are not rewarded and closed as duplicates. (e.g. dev-*-bentley.com, qa- dev-*-bentley.com, prod- dev-*-bentley.com) 
• The reports of the same issue in different deployment regions are not rewarded and closed as duplicates. (e.g. *.us.bentley.com, *.eus-bentley.com, *.in.-*-bentley.com)
• Multiple instances of the same issue will only be compensated to a max of 3x the reward sum. (e.g. expires SSL certificate on 25 domain and subdomains will count 3×100 USD, and not 25×100 USD)

9. Vulnerabilities Triage

• Once your submission is received:
  The reported vulnerability will be analyzed.
• You will be informed if the issue is closed without a reward. We do not send a detailed explanation of the resolution.
• If we determine the submission is valid and meets the requirements of this policy, you may receive a reward after the fix is implemented. Our commitment is to reward your efforts within 90 days.

10. Compensation

The compensation for a security report submitted by a third-party researcher is determined based on the level of risk posed by the identified vulnerability. This means that the reward can vary significantly [or be denied], depending on the potential impact and severity of the issue. While there may be a general range of compensation provided for reference, it is important to understand that each case is evaluated individually. 

To further encourage security researchers and acknowledge your valuable contributions, Bentley Systems has decided to double the rewards for eligible security reports in Q4. This initiative aims to foster greater engagement and incentivize the discovery of critical vulnerabilities, ensuring the continued safety and reliability of Bentley’s products and services.

All reports received in Q4 2025 will be doubled.

NOTE. A report will not be eligible for a financial reward (even if Bentley Systems accepts and addresses it) in some situations including, but not limited to, the following:

• report was submitted by current of former employee of Bentley Systems
• report was submitted by the commercial entities or individuals conducting formal/commercial security testing on behalf of Bentley Systems customers.
• report was submitted by the employee or subcontractors of a company that is a customer of Bentley Systems services.
• report was submitted by the employee of the company that is a Bentley System’s service provider.
• report was submitted by an individual residing in a country that is currently subject to international sanctions.
• Bentley System’s legal department fails to associate researcher’s PayPal email address and the identity; meaning that you cannot get the reward to somebody’s else account.

**Note that multiple instances of the same issue will only be compensated to a max of 3x the price.

**Reports for an issue in different environments of the product (dev-, qa-, prod-) will be counted as one. We reserve the right to change this policy at any time and for any reason and cannot guarantee compensation for all reports. Compensation is only provided through PayPal.  IMPORTANT. Please make sure to send only a valid PayPal address: we will be unable to consider addresses other than the original for payment. If the transaction fails for any reason (i.e. PayPal refuses the transaction; receiving bank cannot accept payment; max amount limit is reached, acceptance of payments only through the website or other instructions, etc.), the payment will be cancelled and will not be resubmitted. Bentley Systems reserves the right to withdraw the Responsible Disclosure Program and its compensation system at any time without prior notice.

File a Report