Standoff Market
Company: Standoff 365Standoff Market is a merchandise catalog for Standoff 365 users. It showcases a unique range of clothing and accessories branded with Standoff identity. Please note that within the current program, no cash prizes are offered or disbursed. All rewards are non-monetary and are credited as Effki - our internal currency, which can be used on the Market.
Rewards are paid to individual entrepreneurs and self-employed persons
Program description
Scope
As part of the Contest, testing is permitted only for the following resource:
*.market.stf365.com
*.market.stf365.com
Important: only resources that are directly and explicitly listed in the Contest scope may be tested. Testing any other domains, subdomains, IP addresses, APIs, services, and components is prohibited.
The existence of a technical, network, or functional connection with Standoff Market, the Standoff 365 Platform, or other Positive Technologies services does not mean that the relevant resource is included in the scope.
Only those APIs and endpoints that are accessible through the resource specified in the scope and directly support the operation of Standoff Market may be tested. Discovery of links, DNS records, API addresses, or other resources outside the scope does not constitute permission to test them.
The existence of a technical, network, or functional connection with Standoff Market, the Standoff 365 Platform, or other Positive Technologies services does not mean that the relevant resource is included in the scope.
Only those APIs and endpoints that are accessible through the resource specified in the scope and directly support the operation of Standoff Market may be tested. Discovery of links, DNS records, API addresses, or other resources outside the scope does not constitute permission to test them.
Prizes
Prizes under the Contest are non-monetary and are awarded in the form of Effki. Effki may be used to obtain clothing and other goods on Standoff Market in accordance with the Bonus Program Rules.
Effki:
• are not monetary funds;
• are not paid in rubles or any other currency;
• cannot be exchanged for money or withdrawn from the platform;
• cannot be transferred to another user unless such possibility is expressly provided for by the platform rules;
• are awarded only after the Report has been reviewed and the Vulnerability has been confirmed by the Organizer.
The number of Effki is determined based on the actual severity level of the Vulnerability.
Effki:
• are not monetary funds;
• are not paid in rubles or any other currency;
• cannot be exchanged for money or withdrawn from the platform;
• cannot be transferred to another user unless such possibility is expressly provided for by the platform rules;
• are awarded only after the Report has been reviewed and the Vulnerability has been confirmed by the Organizer.
The number of Effki is determined based on the actual severity level of the Vulnerability.
| Severity level | Reward |
|---|---|
| Critical | from 4,000 to 5,000 Effki |
| High | from 2,000 to 3,999 Effki |
| Medium | from 500 to 1,999 Effki |
| Low | from 100 to 499 Effki |
The final level and number of Effki are determined by the Organizer taking into account the actual impact on users, data, orders, the Effki balance, and the operation of Standoff Market, as well as the complexity, reproducibility, and scale of exploitation.
The technical class of a Vulnerability does not in itself guarantee a particular severity level. A Vulnerability is assessed based on the impact actually demonstrated. If the impact corresponding to the claimed level is not demonstrated, the Report is assessed at a lower level.
The technical class of a Vulnerability does not in itself guarantee a particular severity level. A Vulnerability is assessed based on the impact actually demonstrated. If the impact corresponding to the claimed level is not demonstrated, the Report is assessed at a lower level.
Vulnerability class guidelines
The table contains key guidelines and the maximum possible level for a typical scenario. The actual level may be lower or higher depending on the impact achieved.
| Level | Key guidelines |
|---|---|
| Critical | RCE with access to data or internal components; SQL Injection enabling mass reading or modification of data |
| High | Authentication bypass or account takeover; IDOR providing access to other users' orders or personal data, or allowing modification of the Effki balance |
| Medium | XXE or SSRF with limited impact; Stored/Reflected XSS or CSRF without takeover of a privileged account |
| Low | Limited disclosure of service information; Open Redirect or another issue with minimal practical impact |
For example, RCE in an isolated environment without access to data may be assessed below the critical level, while IDOR providing mass access to personal data or control over other users' orders may be assessed above the typical guideline.
Vulnerabilities not listed in the table are assessed based on their actual impact. The awarding of Effki for issues that have no practical impact on user security, data, orders, the Effki balance, or the operation of Standoff Market is not guaranteed.
Vulnerabilities not listed in the table are assessed based on their actual impact. The awarding of Effki for issues that have no practical impact on user security, data, orders, the Effki balance, or the operation of Standoff Market is not guaranteed.
Vulnerabilities and reports for which Effki are not awarded
The Organizer does not award Effki:
• for Next.js SSRF;
• for reports generated by security scanners and other automated tools without manual verification and confirmation of exploitation;
• for disclosure of non-secret information, including software names and versions;
• for information about IP addresses, DNS records, and open ports;
• for issues based solely on the version of the product used, without demonstration of their exploitation;
• for vulnerabilities whose exploitation is blocked by information security controls, without demonstration of bypassing such controls;
• for insecure SSL/TLS ciphers, absence of SSL, and other best-practice recommendations without demonstration of practical impact;
• for vulnerabilities previously submitted by other Participants and recognized as duplicates;
• for 0-day vulnerabilities that became publicly known less than 30 days ago, and vulnerabilities with a CVSS score above 8 that became publicly known less than 14 days ago;
• for 1-day vulnerabilities, information about which the Organizer's security team had previously obtained from public sources;
• for mail server configuration deficiencies, including DMARC and DKIM, if they do not directly affect users or application data;
• for Self-XSS and other issues that do not directly affect other users, data, or application operation;
• for vulnerabilities discovered on resources that are explicitly outside the Contest scope.
Reports concerning non-compliance with best practices, such as the absence of the Secure or HttpOnly attributes, may be accepted as informational. Effki are not awarded for such reports.
• for Next.js SSRF;
• for reports generated by security scanners and other automated tools without manual verification and confirmation of exploitation;
• for disclosure of non-secret information, including software names and versions;
• for information about IP addresses, DNS records, and open ports;
• for issues based solely on the version of the product used, without demonstration of their exploitation;
• for vulnerabilities whose exploitation is blocked by information security controls, without demonstration of bypassing such controls;
• for insecure SSL/TLS ciphers, absence of SSL, and other best-practice recommendations without demonstration of practical impact;
• for vulnerabilities previously submitted by other Participants and recognized as duplicates;
• for 0-day vulnerabilities that became publicly known less than 30 days ago, and vulnerabilities with a CVSS score above 8 that became publicly known less than 14 days ago;
• for 1-day vulnerabilities, information about which the Organizer's security team had previously obtained from public sources;
• for mail server configuration deficiencies, including DMARC and DKIM, if they do not directly affect users or application data;
• for Self-XSS and other issues that do not directly affect other users, data, or application operation;
• for vulnerabilities discovered on resources that are explicitly outside the Contest scope.
Reports concerning non-compliance with best practices, such as the absence of the Secure or HttpOnly attributes, may be accepted as informational. Effki are not awarded for such reports.
Participant requirements
Only citizens of the Russian Federation who are 18 years of age or older may participate in the Contest.
Participants must:
- comply with these Terms, the Contest Rules, the Standoff 365 vulnerability disclosure rules, and the general rules of the Standoff 365 Bug Bounty platform;
- conduct testing exclusively within the explicitly specified scope;
- maintain the confidentiality of the information obtained;
- not intentionally access other users' data without their consent and not modify, delete, or distribute such data;
- maintain communication with the Organizer, submit properly prepared Reports, and provide additional information upon request;
- not disclose information about a Vulnerability before an agreed public disclosure;
- stop testing and notify the Organizer if there is a risk of service unavailability, data damage, or impact on other users.
Public disclosure of vulnerability information
Public disclosure of information is permitted only by mutual agreement between the Participant and the Organizer. The Parties shall separately agree on the timing, scope, and format of the information to be disclosed. Until such agreement is obtained, the Participant must keep information about the Vulnerability confidential.
Prohibited actions
Participants are prohibited from:
• testing resources that are not explicitly specified in the Contest scope;
• affecting other users' accounts without their permission;
• using a discovered Vulnerability for personal purposes;
• obtaining goods, modifying the Effki balance, or gaining other advantages by exploiting a Vulnerability;
• carrying out actual transactions involving other users' orders, promo codes, payment data, or accounts;
• using tools that automatically generate significant traffic volumes or service load;
• conducting DoS, DDoS, and brute-force attacks, as well as attacks aimed at resource exhaustion;
• modifying or deleting data that does not belong to the Participant;
• conducting physical attacks against employees, offices, and data centers;
• using social engineering, including phishing, vishing, and spam mailings;
• investigating the server infrastructure on which applications are hosted unless it is separately specified in the scope;
• exceeding the minimum impact necessary to confirm a Vulnerability;
• storing, copying, or distributing personal, confidential, or other sensitive data.
If demonstrating a Vulnerability requires an action capable of affecting service availability, data integrity, or other users, testing must be stopped and a description of the proposed scenario must be provided to the Organizer.
If several independent security issues are discovered during the research, a separate Report must be prepared for each Vulnerability.
• testing resources that are not explicitly specified in the Contest scope;
• affecting other users' accounts without their permission;
• using a discovered Vulnerability for personal purposes;
• obtaining goods, modifying the Effki balance, or gaining other advantages by exploiting a Vulnerability;
• carrying out actual transactions involving other users' orders, promo codes, payment data, or accounts;
• using tools that automatically generate significant traffic volumes or service load;
• conducting DoS, DDoS, and brute-force attacks, as well as attacks aimed at resource exhaustion;
• modifying or deleting data that does not belong to the Participant;
• conducting physical attacks against employees, offices, and data centers;
• using social engineering, including phishing, vishing, and spam mailings;
• investigating the server infrastructure on which applications are hosted unless it is separately specified in the scope;
• exceeding the minimum impact necessary to confirm a Vulnerability;
• storing, copying, or distributing personal, confidential, or other sensitive data.
If demonstrating a Vulnerability requires an action capable of affecting service availability, data integrity, or other users, testing must be stopped and a description of the proposed scenario must be provided to the Organizer.
If several independent security issues are discovered during the research, a separate Report must be prepared for each Vulnerability.
Rules for conducting the Standoff Market software vulnerability detection contest
1. TERMS
| Term | Definition |
|---|---|
| Rules | A set of rules governing the organization and conduct of the Standoff Market software vulnerability detection contest, including appendices and amendments thereto |
| Contest | A contest for detecting vulnerabilities in the Resource, conducted in accordance with the Rules for the purposes of: improving user security; preventing incidents affecting third parties; encouraging Participants' educational and learning activities in the field of cybersecurity; developing the professional community and promoting the field of cybersecurity |
| Organizer | Joint Stock Company Positive Technologies, Primary State Registration Number (OGRN) 1077761087117, registered office: Premises 60, 8 Preobrazhenskaya Square, Preobrazhenskoye Municipal District, Moscow, 107061, a legal entity that ensures the conduct of the Contest and at whose expense the prize fund is formed |
| Bug Bounty Platform | The website located at bugbounty.standoff365.com, through whose functionality Reports are submitted and reviewed |
| Platform | The Standoff 365 Platform located at: https:// standoff365.com/ |
| Standoff Market | The service located at market.stf365.com and intended for users, where Participants can obtain branded products (merchandise) and other items of value in exchange for Effki |
| Resource | The set of domains and subdomains within Standoff Market, as well as application programming interfaces (APIs) and endpoints accessible through those domains and directly supporting the operation of Standoff Market, testing of which is permitted as part of the Contest. |
| Contest Page | The webpage located at: https://bugbounty.standoff365.com/programs/stf_merch, on which information about the Contest, these Rules, and other information related to the conduct of the Contest is posted |
| Participant | An individual who meets the requirements of Section 3 of the Rules, is registered on the Bug Bounty Platform, and has submitted a Report in accordance with the procedure established by the Rules |
| Prize Winner | Participants who, in accordance with the Rules, fulfill the conditions for receiving a Prize. Prize Winner status is granted to a Participant who has completed the Task, regardless of the results of other Participants |
| Task | A set of actions the performance of which is stipulated by the Rules as the basis for receiving a Prize: identifying a Vulnerability in the Resource within the scope and in compliance with the restrictions established by Appendix No. 1, and submitting a Report to the Organizer. The result of completing the Task is a Report. The Task is deemed completed by the Participant from the moment the Report submitted by the Participant is assigned the status "Accepted" |
| Report | An electronic document submitted by the Participant to the Organizer by completing a form in the personal account on the Bug Bounty Platform, containing the result and description of the completed Contest task. |
| Vulnerability | A technical deficiency in the Resource that may be used to disrupt its normal operation, integrity, availability, confidentiality, and/or cause an unacceptable event resulting from malicious actions. |
| Prize (Effki) | A Prize awarded in the ways provided for by the Rules as part of the Contest when the Participant fulfills the conditions for receiving it specified in the Rules. A virtual notional unit of the Standoff Market bonus program credited to the Participant's bonus account and used to obtain branded products and other items of value on Standoff Market in accordance with the procedure and on the terms established by the Bonus Program Rules. The terms of use of Effki, including restrictions on their use and circulation, are established by the Bonus Program Rules |
| Bonus Program Rules | The Standoff Market Bonus Program Rules located at: https://market.stf365.com/upload/136-%D0%9E%D0%94.2026-1%20%D0%BE%D1%82%2015.06.2026.pdf |
| Personal Account | A personal (individual) internal page of a registered user on the Bug Bounty Platform, the Platform, and/or Standoff Market |
2. GENERAL TERMS AND CONDITIONS OF THE CONTEST
Contest period
From July 24, 2026 until the date on which the Organizer fulfills its obligation to credit Effki in respect of the last Report submitted during the Task completion period.
Task completion period: from July 24, 2026 through July 31, 2026, inclusive.
The Organizer may extend the Contest period, as well as suspend or terminate the Contest early, by posting the relevant information on the Contest Page.
From July 24, 2026 until the date on which the Organizer fulfills its obligation to credit Effki in respect of the last Report submitted during the Task completion period.
Task completion period: from July 24, 2026 through July 31, 2026, inclusive.
The Organizer may extend the Contest period, as well as suspend or terminate the Contest early, by posting the relevant information on the Contest Page.
Time limits and procedure for submitting Task results to the Organizer
Reports shall be submitted to the Organizer during the Contest period specified in this section using the functionality of the Personal Account on the Bug Bounty Platform.
The date and time of submission of a Report shall be deemed to be the date and time of its registration in the Organizer's information system.
Reports submitted before the start or after the expiration of the Contest period shall not be accepted for consideration as part of the Contest, and Effki shall not be awarded for such Reports.
Reports shall be submitted to the Organizer during the Contest period specified in this section using the functionality of the Personal Account on the Bug Bounty Platform.
The date and time of submission of a Report shall be deemed to be the date and time of its registration in the Organizer's information system.
Reports submitted before the start or after the expiration of the Contest period shall not be accepted for consideration as part of the Contest, and Effki shall not be awarded for such Reports.
Time limits and procedure for evaluating Task results
Reports are reviewed by the Organizer's employee experts who have the necessary qualifications, based on their professional experience and knowledge, as well as the conditions established by Appendix No. 1.
Reports are reviewed as they are received. The review period for a Report shall not exceed 90 (ninety) calendar days from the date of its submission by the Participant.
Following the review, the Report is assigned a status and, if the Vulnerability is confirmed, a severity level determined in accordance with the procedure established by the Rules. The Organizer may decline to consider Reports that do not comply with the requirements of the Rules and Appendix No. 1.
Expiration of the Contest period, as well as its suspension or early termination, shall not terminate the Organizer's obligation to review Reports submitted during the Contest period and award Effki in accordance with the procedure established by the Rules
Reports are reviewed by the Organizer's employee experts who have the necessary qualifications, based on their professional experience and knowledge, as well as the conditions established by Appendix No. 1.
Reports are reviewed as they are received. The review period for a Report shall not exceed 90 (ninety) calendar days from the date of its submission by the Participant.
Following the review, the Report is assigned a status and, if the Vulnerability is confirmed, a severity level determined in accordance with the procedure established by the Rules. The Organizer may decline to consider Reports that do not comply with the requirements of the Rules and Appendix No. 1.
Expiration of the Contest period, as well as its suspension or early termination, shall not terminate the Organizer's obligation to review Reports submitted during the Contest period and award Effki in accordance with the procedure established by the Rules
Procedure for notification of results
Information on the commencement and duration of the Contest shall be posted on the Contest Page and may also be communicated to Participants through the official Standoff 365 Telegram channel.
The Participant shall be informed of the progress of the Report review, comments from the Organizer's reviewing specialists, and the final status of the Report through the Participant's Personal Account on the Bug Bounty Platform.
Information on the commencement and duration of the Contest shall be posted on the Contest Page and may also be communicated to Participants through the official Standoff 365 Telegram channel.
The Participant shall be informed of the progress of the Report review, comments from the Organizer's reviewing specialists, and the final status of the Report through the Participant's Personal Account on the Bug Bounty Platform.
2.1. The decision to participate in the Contest is voluntary and is made by each Participant at their own discretion.
2.2. The Organizer independently determines the terms and conditions of the Contest, including:
- the Contest period;
- requirements for Participants;
- actions that the Participant must perform in order to participate;
- criteria for evaluation and selection of Prize Winners;
2.3. The territory of the Contest is the Russian Federation.
2.4. By submitting a Report, the Participant:
- agrees to these Rules and the Bonus Program Rules and confirms that they have reviewed their contents;
- confirms compliance with the criteria and requirements established for Participants.
2.5. The Regulations on programs conducted on the Standoff 365 Bug Bounty platform, available at https://standoff365.com/regulation-on-contests, shall not apply to relations between the Organizer and Participants within the Contest.
2.6. Testing of the Resource within the limits and in accordance with the procedure established by the Rules is performed with the Organizer's permission. Actions by the Participant performed in violation of the established restrictions, as well as actions in relation to resources not included in the Contest scope, are not authorized by the Organizer.
3. REQUIREMENTS FOR PARTICIPANTS
3.1. A Participant in the Contest may be a legally capable individual who has reached the age of 18 and is registered on the Bug Bounty Platform.
3.2. An individual between 14 and 18 years of age may participate in the Contest with the written consent of their legal representative (parent, adoptive parent, or guardian) to participate in the Contest and comply with these Rules. Such individual undertakes to provide the Organizer with a copy of the said consent upon the Organizer's request. Failure to provide the consent shall constitute grounds for refusal to award Effki or for cancellation of Effki already awarded.
3.3. Current employees of the Organizer and its affiliated persons, as well as former employees of the Organizer whose employment relationship was terminated less than 3 (three) years ago, may submit Reports; however, Effki shall not be awarded to such persons as part of the Contest.
3.4. Persons involved in organizing and conducting the Contest, including specialists reviewing Reports, members of their families, as well as authors of the Resource code, may not be Participants in the Contest.
3.5. To participate in the Contest, a Participant may use only their own account, including when testing the Resource and demonstrating Vulnerabilities. Providing third parties with access to the account, as well as participating in the Contest on behalf of another person, is not permitted.
3.6. Persons who do not meet the requirements applicable to Participants shall not be recognized as Participants in the Contest.
4. RIGHTS AND OBLIGATIONS OF PARTICIPANTS
4.1. Participants shall have the rights and bear the obligations established by the applicable legislation of the Russian Federation and these Rules.
4.2. A Participant may not transfer (assign) their rights and/or obligations to a third party (third parties), including the right to receive a Prize from the Organizer.
4.3. Participants take part in the Contest on their own behalf. Participants must provide accurate information about themselves. Participants who provide inaccurate, misleading, or false information are not entitled to participate in the Contest, and all completed Tasks of a Participant who, in the Organizer's opinion, provided inaccurate, misleading, or false information may, at the Organizer's discretion, be deemed invalid.
4.4. Participants must comply with these Rules, act in good faith, demonstrate activity, creativity, and interest in participating in the Contest, and refrain from harming the business reputation of the Organizer, other Participants, and third parties.
4.5. Participants shall independently bear any expenses incurred in connection with participation in the Contest.
4.6. If any data or information must be clarified for the purpose of the Organizer's performance of its obligations to conduct the Contest under these Rules, as well as for the purpose of the Organizer's performance of its obligation to award Prizes, Participants must communicate with the Organizer and provide the necessary explanations and clarifications. If a Participant fails to fulfill this obligation, the Organizer shall not be liable for failure to perform its obligations as part of this Contest resulting from the failure to provide information or the provision of incomplete or incorrect information by the Participant.
4.7. A Participant may submit an unlimited number of Reports, provided that a separate Report is submitted for each independent Vulnerability.
5. RIGHTS AND OBLIGATIONS OF THE ORGANIZER
5.1. The Organizer undertakes to conduct the Contest in accordance with the procedure established by these Rules and the legislation of the Russian Federation.
5.2. The Organizer reserves the right to verify documents confirming the Participant's age and identity (including a passport) and to request other information required for the purposes of conducting the Contest and awarding the Prize.
5.3. The Organizer may unilaterally amend the terms of the Rules. Such amendments shall enter into force upon publication of the new version of the Rules on the Contest Page.
5.4. The Organizer has the right, at its sole discretion, without explaining the reasons to Participants or entering into correspondence with them, to declare any actions of Participants invalid and to prohibit any person from further participation in the Contest if the Organizer has reasonable grounds to suspect that such person is falsifying data or deriving benefit from any falsification of data required for participation in the Contest, including, without limitation, the following actions:
- if the Participant has been found to have committed fraud or deception that has caused or may cause adverse consequences of various types and degrees for the Organizer and other Participants,
- if the Participant acts in violation of these Rules.
5.5. The Organizer may decide not to admit Task solutions that do not comply with the requirements of these Rules to participation in the Contest, as well as where the content of the Task solution is contrary to the legislation of the Russian Federation. The Organizer is not required to notify the Contest Participant of the reasons for such refusal.
5.6. The Organizer may refuse to award Effki, cancel Effki previously awarded, and/or block the Participant's account on the Bug Bounty Platform if the Participant violates these Rules, as well as if the Participant provides inaccurate, incomplete, or knowingly false information.
6. REQUIREMENTS FOR TASK SOLUTIONS
6.1. Reports must be created through the Participant's own personal creative effort.
6.2. Reports must comply with the requirements established for them by the Rules.
6.3. Reports must not:
- contain obscene or offensive statements of any kind, including information that violates generally accepted standards of humanity and morality through the use of offensive words, comparisons, or images in relation to the race, nationality, profession, social category, age group, sex, language, religious, philosophical, political, or other beliefs of individuals;
- contain threats, discredit, insult, or defame the honor, dignity, or business reputation of the Organizer or any individuals or legal entities;
- contain advertising in an explicit or concealed form;
- promote criminal activity or contain advice, instructions, or guidance on committing criminal acts;
- contain restricted-access information, including state and commercial secrets and information about the private lives of third parties;
- contain third-party intellectual property (including, without limitation, graphic and textual works, trademarks, service marks, etc.), except for intellectual property for the use of which (including its inclusion in the Task solution, with the right to grant/transfer the relevant rights to the Organizer) the Participant has obtained the right holder's consent and/or the use of which is permitted by the legislation of the Russian Federation without the need to obtain the right holder's consent;
- violate the requirements of the applicable legislation of the Russian Federation.
6.4. The result of completing the Task is a Report. The Report must specify the name and description of the Vulnerability. It may also contain: information about the severity level of the Vulnerability (except for reporting an unacceptable event); CVE (Common Vulnerabilities and Exposures), a Vulnerability identification number in the format "CVE-year-number," a description, and a number of publicly available links containing descriptions; CWE (Common Weakness Enumeration), a common list of security defects (weaknesses); attached files.
6.5. A separate Report shall be submitted for each independent Vulnerability.
6.6. The severity level of the Vulnerability shall be determined by the Organizer based on the conditions established by Appendix No. 1.
6.7. A Report may be assigned the status "Duplicate" if another Participant previously submitted a similar Report (including where the Reports describe different vectors for exploiting the same Vulnerability), or if the described Vulnerability was previously known to the Organizer or its contractors and this was explicitly documented, or if information about the Vulnerability became publicly available before the Report was submitted.
6.8. Where several Participants submit Reports concerning the same Vulnerability, the right to receive Effki shall arise for the Participant who submitted the Report first. Priority shall be determined by the date and time of registration of the Report in the Organizer's information system. Reports submitted by other Participants shall be recognized as duplicates.
7. GENERAL TERMS AND CONDITIONS FOR AWARDING AND RECEIVING PRIZES
7.1. Effki shall be awarded to each Participant who has completed the Task and whose Report has received the status "Accepted" with a severity level of "Low" or higher, regardless of the results of other Participants and without matching (comparing) Participants' Reports against one another.
7.2. No monetary reward is assigned or paid as part of the Contest. Effki may not be replaced with monetary funds, and their value shall not be paid in monetary form.
7.3. The number of Effki awarded, as well as the list of Vulnerabilities and Reports for which Effki are not awarded, are established by Appendix No. 1.
7.4. Effki are also not awarded for Reports assigned the status "Duplicate."
7.5. Effki shall be awarded within 30 (thirty) calendar days from the date on which the Report is assigned the status "Accepted."
7.6. The accounting, use, validity period, and deduction of awarded Effki shall be carried out in accordance with the procedure and on the terms established by the Bonus Program Rules.
7.7. When branded products and other items of value are provided to a Prize Winner on Standoff Market, the Organizer shall perform the duties of a tax agent in accordance with the legislation of the Russian Federation on taxes and levies and in accordance with the procedure established by the Bonus Program Rules. For the purpose of performing these duties, the Prize Winner undertakes to provide the Organizer, upon request, with the information and documents specified in the Bonus Program Rules.
7.8. The Organizer's obligation to award the Prize shall be deemed fulfilled from the moment Effki are credited to the Participant's bonus account in Standoff Market.
8. RESULTS OF INTELLECTUAL ACTIVITY
8.1. Reports are intellectual property. The Participant grants the Organizer the right to use the Reports to any extent throughout the world for the entire term of the exclusive right (and, in the case specified in Clause 8.2 of the Rules, until the exclusive rights are assigned) under a simple (non-exclusive) license by the following means: reproduction, distribution, public display, making available to the public, adaptation for any purpose, as well as with the right to transfer such right of use to any third parties without payment of remuneration to the Participant.
The Participant grants the right to use the Report from the moment it is submitted to the Organizer in accordance with the procedure established by the Rules.
8.2. Participants recognized as Prize Winners of the Contest shall assign the exclusive rights to the Reports to the Organizer in full from the moment the Participant is recognized as a Prize Winner of the Contest.
The remuneration for the assignment of the exclusive rights to the Report shall be the awarding of Effki to the Prize Winner in the amount determined by the Rules. No other remuneration for the assignment of exclusive rights shall be paid by the Organizer.
8.3. At the time the Report is submitted to the Organizer, the Participant gives their consent (for the entire term of the exclusive right to the Report):
- to the use (including publication) of the Report by the Organizer (its legal successors) with the Participant's name indicated, anonymously, or under a pseudonym (depending on what was specified by the Participant when submitting the Report, and if no relevant indication was provided, in any manner at the Organizer's discretion);
- to the Organizer (its legal successors) making amendments, abridgements, and additions to the Report and supplementing it, when used, with illustrations, a preface, an afterword, comments, or any explanations, including in the future;
- to the Organizer taking actions that make the Report available to the public for the first time by publication, public display, public performance, broadcasting, cable transmission, or by any other means, subject to the restrictions established by Appendix No. 1. The Organizer may, at its discretion, publish the Report and choose the time, place, method, and other conditions of such publication.
8.4. As of the date the Report is transferred to the Organizer, the Participant represents to the Organizer that the Report was created without infringement and that its transfer to the Organizer and its use by the Organizer (its legal successors) in accordance with the Rules do not infringe the intellectual rights (including property rights and personal non-property rights) of third parties; the Report (the rights thereto) is not encumbered by third-party rights or claims. The Participant shall independently bear the liability prescribed by the applicable legislation of the Russian Federation for infringement of the intellectual or other rights of third parties. If third parties bring claims or actions against the Organizer alleging infringement of their intellectual or other rights as a result of the Organizer's use of the Report, the Participant undertakes to settle such claims and actions independently and at their own expense and to compensate the Organizer for all losses incurred, including, without limitation, all legal costs incurred by the Organizer in defending against third-party claims.
8.5. If the Participant created the Report jointly with co-authors, as of the date the Report is transferred to the Organizer, the Participant represents to the Organizer that they have taken all necessary actions and executed all necessary and sufficient documents relating to the assignment of exclusive rights to the Report (if the Participant is recognized as a Prize Winner of the Contest) or the granting to the Organizer of rights of use in accordance with Clause 8.1 of the Rules; and that they have obtained all necessary consents from the co-authors for anonymous use of the Report (without indicating the authors' names). If a Participant who created a Report jointly with co-authors is recognized as a Prize Winner of the Contest, the Prize Winner undertakes to independently settle with all co-authors all matters relating to the distribution of remuneration.
8.6. All representations specified in the Rules are material to the Organizer.