Bug Bounty

[holyfuchs]

Standing bug bounty program (vendor, scope, payout tiers).

[peterxing]

Opened a conservative first pass here: #36

It adds a root SECURITY.md with private report intake, scope boundaries, severity guide, draft payout tiers, coordinated disclosure steps, and safe-harbor wording that can be adapted once a vendor/process is selected.

If useful, I can also turn this into the full vendor-ready packet (scope matrix, HackerOne/Immunefi-style intake text, triage SLA, final payout rubric, and launch checklist) as a fixed A$690 docs/security-program job. Contact: info@transhumanism.com.au.

[Euvouserdoutor]

Hello maintainers, I can work on this item and provide a focused PR with a short summary. For faster coordination, contact me at jeffqueiroz321@gmail.com

[MKT2m]

🤖 Fix by Z.AI Overlord v6.2

`python

# Bug Bounty Program - [Your Company Name]

At [Your Company Name], we are deeply committed to protecting our users and ensuring the security of our products and services. We recognize the invaluable role that independent security researchers play in helping us identify and remediate vulnerabilities. This program outlines the guidelines, scope, and reward structure for responsibly disclosing security flaws within our systems.

We appreciate the efforts of security researchers and aim to foster a collaborative environment.

---

## Program Details

### 1. Vendor

**[Your Company Name]**
[Your Company Website/URL]
[A brief description of your company/mission relevant to security]

---

### 2. Scope

**In-Scope Assets (Eligible for Rewards):**

*   **Primary Web Application(s):**
    *   `https://www.[your-domain].com`
    *   `https://app.[your-domain].com`
    *   `https://api.[your-domain].com`
*   **Mobile Applications:**
    *   [Your Company Name] App for iOS (latest version available on App Store)
    *   [Your Company Name] App for Android (latest version available on Google Play)
*   **Publicly Accessible APIs:** Any API endpoints explicitly documented and owned by [Your Company Name].
*   **Other:** Any other assets explicitly listed or identified by [Your Company Name] as being in-scope.

**Out-of-Scope Assets & Vulnerabilities (Not Eligible for Rewards):**

*   **Third-Party Services:** Services hosted by third parties unless a direct vulnerability in our integration exists.
*   **Informational/Low-Impact Issues:**
    *   Missing HTTP security headers (e.g., CSP, X-Frame-Options, HSTS) without a demonstrated exploit.
    *   Verbose error messages/stack traces without sensitive data exposure or direct exploitability.
    *   Self-XSS (unless a practical attack vector for another user can be demonstrated).
    *   Clickjacking on pages with no sensitive actions or impact.
    *   Logout CSRF.
    *   Vulnerabilities requiring an extremely unlikely user interaction.
    *   Descriptive error messages, banner disclosure on non-sensitive services.
    *   Any issues related to SPF, DKIM, DMARC without a clear, demonstrable impact on our users.
*   **Denial of Service (DoS/DDoS) Attacks:** Any attempts to degrade service or impact availability.
*   **Social Engineering:** Any attempts to phish, trick, or mislead [Your Company Name] employees or users.
*   **Physical Attacks:** Any attempts to gain physical access to [Your Company Name] offices or data centers.
*   **Vulnerabilities in Outdated Software/Browsers:** Issues only reproducible on unsupported browsers or legacy software versions.
*   **Automated Scanner Output:** Reports based solely on automated scanner output without manual verification and a proof-of-concept.
*   **Vulnerabilities in `*.test.[your-domain].com` or similar staging/dev environments** unless explicitly stated.

---

### 3. Reporting Guidelines & Rules

To ensure a smooth and effective process, please adhere to the following guidelines:

*   **Responsible Disclosure:** Do not publicly disclose any vulnerabilities until they have been fully resolved by [Your Company Name] and you have received explicit permission.
*   **Detailed Reports:** Provide clear, concise, and reproducible steps for the vulnerability. Include:
    *   A comprehensive description of the vulnerability.
    *   The affected URL(s) or application functionality.
    *   Steps to reproduce (with screenshots, video, or code if applicable).
    *   Impact of the vulnerability.
    *   Any suggestions for remediation (optional, but appreciated).
*   **Proof-of-Concept (PoC):** A well-crafted PoC is crucial for assessing your finding.
*   **No Data Access/Modification:** Do not access, modify, or destroy any user data without explicit permission. Only test on accounts you own or have explicit permission to use.
*   **No Service Degradation:** Avoid any actions that could negatively impact our services or user experience.
*   **Privacy:** Respect user privacy. Do not attempt to access or exfiltrate private user data.
*   **Duplicate Submissions:** The first legitimate report of a unique vulnerability will be eligible for a bounty.
*   **Language:** All reports must be submitted in English.

**How to Submit a Report:**

Please submit your vulnerability reports through our dedicated platform:
[Link to your bug bounty platform, e.g., HackerOne, Bugcrowd, or a secure email address like `security@[your-domain].com`]

---

### 4. Payout Tiers & Rewards

Rewards are granted based on the severity, impact, and exploitability of the reported vulnerability, as determined by [Your Company Name]’s internal security team. We generally use the CVSS v3.1 scoring system as a guide.

Payouts are discretionary and subject to [Your Company Name]'s final decision.

*   **Critical (CVSS 9.0-10.0)**
    *   **Examples:** Remote Code Execution (RCE), Authentication Bypass, Major Data Breach, SQL Injection leading to significant data access (authenticated or unauthenticated).
    *   **Reward Range:** $X,XXX - $XX,XXX USD
*   **High (CVSS 7.0-8.9)**
    *   **Examples:** Significant Cross-Site Scripting (Persistent XSS on critical pages, Reflected XSS with high impact), Sensitive Insecure Direct Object Reference (IDOR), Server-Side Request Forgery (SSRF) with limited impact, Broken Authentication/Session Management.
    *   **Reward Range:** $XXX - $X,XXX USD
*   **Medium (CVSS 4.0-6.9)**
    *   **Examples:** Cross-Site Request Forgery (CSRF) on moderately sensitive actions, Non-persistent XSS on non-critical pages, Open Redirect with potential for phishing, Information Disclosure (non-sensitive but useful).
    *   **Reward Range:** $XX - $XXX USD
*   **Low (CVSS 0.1-3.9)**
    *   **Examples:** Configuration issues without demonstrable impact, Verbose error messages without sensitive data, Clickjacking with minimal impact, Certain enumeration vulnerabilities.
    *   **Reward Range:** $X - $XX USD (or non-monetary recognition/swag)

**Important Notes:**

*   **No Fixed Bounties:** The listed ranges are indicative. Actual bounties may vary.
*   **Quality over Quantity:** Focus on impact and quality of findings.
*   **No Reward for Out-of-Scope:** Vulnerabilities found on out-of-scope assets or falling into out-of-scope categories will not be rewarded.
*   **Eligibility:** You must not be an employee of [Your Company Name] or an immediate family member of an employee. You must comply with all applicable laws and regulations.
*   **Taxes:** All bounty payments are subject to applicable taxes, which are the sole responsibility of the recipient.

---

### 5. Legal & Disclaimer

By submitting a report to [Your Company Name]'s Bug Bounty Program, you agree to these terms and conditions. [Your Company Name] reserves the right to modify or terminate this program at any time, for any reason, without prior notice. All decisions regarding eligibility, scope, and bounty amounts are at the sole discretion of [Your Company Name]. Your testing must not violate any law, nor disrupt any service.

---

### 6. Contact & Updates

For any questions about the program or to submit a report, please use our designated [reporting email/platform link].
Any updates to this program will be posted on [Link to your security page/blog/bounty platform].

Thank you for helping us keep [Your Company Name] secure!

---
💰 Bounty Tips TON Wallet: UQBqg70EDHyFNYme2_I_7fj0r2da36NikiYW_v0VzSD3grxM

[MKT2m]

🤖 Fix by Z.AI Overlord v6.2

`python

{
  "title": "Bug Bounty Program Definition",
  "description": "A comprehensive template for defining a standing bug bounty program, including vendor details, scope, and payout tiers.",
  "program_config": {
    "vendor": {
      "name": "[Your Organization Name]",
      "website": "[https://www.your-organization.com]",
      "security_contact_email": "[security@your-organization.com]",
      "legal_entity_id": "[Optional: Legal entity identifier if applicable]"
    },
    "scope": {
      "in_scope_targets": [
        {
          "type": "web_application",
          "name": "Main Application",
          "url": "[https://app.your-organization.com]",
          "description": "Our primary customer-facing web application.",
          "assets": [
            "*.your-organization.com",
            "your-organization.com"
          ]
        },
        {
          "type": "api",
          "name": "Public API",
          "url": "[https://api.your-organization.com/v1]",
          "description": "Our public REST API endpoints.",
          "assets": [
            "api.your-organization.com"
          ]
        },
        {
          "type": "mobile_application",
          "name": "Mobile App (iOS)",
          "store_link": "[https://apps.apple.com/us/app/your-app/id123456789]",
          "description": "Official iOS application."
        },
        {
          "type": "mobile_application",
          "name": "Mobile App (Android)",
          "store_link": "[https://play.google.com/store/apps/details?id=com.your.app]",
          "description": "Official Android application."
        }
      ],
      "out_of_scope_targets": [
        "Third-party services or integrations (unless explicitly owned and controlled by us)",
        "Denial of Service (DoS) attacks",
        "Social engineering or phishing attempts against employees/users",
        "Physical security attacks",
        "Vulnerabilities requiring significant user interaction (e.g., self-XSS without practical exploitation for other users)",
        "Missing best practices (e.g., missing security headers, SPF/DKIM/DMARC unless direct exploitable impact shown)",
        "Vulnerabilities in outdated browser versions or plugins",
        "Disclosure of public information (e.g., server banners, public IP addresses)",
        "Non-security best practice warnings from automated scanners without demonstrated impact"
      ],
      "scope_notes": "The scope may be updated periodically. Refer to the official program page for the latest information."
    },
    "payout_tiers": [
      {
        "severity": "critical",
        "description": "Remote Code Execution, SQL Injection, Authentication Bypass, Sensitive Data Exfiltration with significant impact.",
        "min_reward_usd": 2000,
        "max_reward_usd": 10000,
        "example_vulnerabilities": ["RCE", "SQLi (authenticated/unauthenticated)", "Auth Bypass for admin", "Mass data exfiltration"]
      },
      {
        "severity": "high",
        "description": "Persistent Cross-Site Scripting (XSS), Significant Business Logic Flaws, Authentication/Authorization Flaws (non-admin).",
        "min_reward_usd": 750,
        "max_reward_usd": 2000,
        "example_vulnerabilities": ["Stored XSS", "Horizontal privilege escalation", "Sensitive PII disclosure"]
      },
      {
        "severity": "medium",
        "description": "Reflected Cross-Site Scripting (XSS), CSRF (with limited impact), Security Misconfigurations.",
        "min_reward_usd": 250,
        "max_reward_usd": 750,
        "example_vulnerabilities": ["Reflected XSS", "CSRF (account settings)", "Open redirect (post-auth)"]
      },
      {
        "severity": "low",
        "description": "Informational findings, very limited impact vulnerabilities, missing security headers (without direct exploitation).",
        "min_reward_usd": 50,
        "max_reward_usd": 250,
        "example_vulnerabilities": ["Clickjacking (limited impact)", "Mixed content", "Verbose error messages"]
      ]
    },
    "rules_of_engagement": [
      "Do not access, modify, or delete data belonging to other users or our organization.",
      "Do not attempt to disrupt or degrade our services (e.g., DoS attacks).",
      "Do not perform any physical attacks or social engineering against our employees or infrastructure.",
      "Submit detailed vulnerability reports with clear steps to reproduce, impact, and a proof-of-concept (PoC).",
      "Do not disclose vulnerability information publicly without explicit written consent from our organization.",
      "Only test against the explicitly defined in-scope targets.",
      "Reports that are duplicative, out of scope, or previously known may not be eligible for a bounty.",
      "We reserve the right to determine the severity and eligibility of any reported vulnerability."
    ],
    "submission_platform": {
      "type": "direct_submission",
      "url": "[https://bugbounty.your-organization.com/submit]",
      "instructions": "Use our dedicated submission portal. Ensure all required fields are filled out."
    },
    "program_status": "active",
    "last_updated": "2023-10-27T10:30:00Z"
  }
}

---
💰 Bounty Tips TON Wallet: UQBqg70EDHyFNYme2_I_7fj0r2da36NikiYW_v0VzSD3grxM