Bountytalk Launched

Recent Posts

Pages: [1] 2 3 ... 10
1
Bug bounty programs / RollBar Bug Bounty
« Last post by Angelina on September 20, 2023, 07:27:08 PM »
submit bug report: https://docs.rollbar.com/docs/responsible-disclosure-policy

Responsible Disclosure Policy
Suggest Edits
Rollbar aims to keep its Services safe for everyone, and data security is of utmost priority. If you are a security researcher and have discovered a security vulnerability in the Services, we appreciate your help in disclosing it to us in a responsible manner.

Rollbar will engage with security researchers when vulnerabilities are reported to us in accordance with this Responsible Disclosure Policy. We will validate, respond and fix vulnerabilities in accordance with our commitment to security and privacy. We won't take legal action against or suspend or terminate access to the Services of those who discover and report security vulnerabilities in accordance with this Responsible Disclosure Policy. Rollbar reserves all of its legal rights in the event of any noncompliance.

Capitalized terms used in this Responsible Disclosure Policy and not otherwise defined have the meaning ascribed to such terms in our Terms of Service.

Testing
You may test only against an Account for which you are the Account owner or a Member authorized by the Account owner to conduct such testing. In no event are you permitted to access, download or modify data residing in any other Account or that does not belong to you or attempt to do any of the foregoing. You are also prohibited from:

executing or attempting to execute any "Denial of Service" attack;
knowingly posting transmitting, uploading, linking to, sending or storing any Malicious Software;
testing in a manner that would result in the sending unsolicited or unauthorized junk mail, spam, pyramid schemes or other forms of duplicative or unsolicited messages;
testing in a manner that would degrade the operation of the Services;
testing third party applications or websites or services that integrate with or link to the Services.
Reporting
Share the details of any suspected vulnerabilities with the Rollbar Security Team by sending an email to [email protected]. Please do not publicly disclose these details without express written consent from Rollbar. In reporting any suspected vulnerabilities, please include the following information:

Vulnerability details with information to allow us to efficiently reproduce your steps
Your email address
Your name as it should be displayed on this page if you would like it to be
Your Twitter handle or website as it should be displayed
Compensation Requests
Requests for monetary compensation in connection with any identified or alleged vulnerability will be deemed noncompliant with this Responsible Disclosure Policy.

Our Commitment
If you identify a verified security vulnerability in compliance with this Responsible Disclosure Policy, Rollbar commits to:

Promptly acknowledge receipt of your vulnerability report
Provide an estimated timetable for resolution of the vulnerability
Notify you when the vulnerability is fixed
Publicly acknowledge your responsible disclosure
2
Bug bounty programs / Robeco Bug Bounty
« Last post by Angelina on September 20, 2023, 07:26:17 PM »
submit bug report: https://www.robeco.com/en/responsible-disclosure.html

Working on system security
Every day, specialists at Robeco are busy improving the systems and processes. This helps to protect the details of our clients against misuse and also ensures the continuity of our services. However, this does not mean that our systems are immune to problems. If problems are detected, we would like your help.

What can we expect from one another?
Report any problems about the security of the services Robeco provides via the internet. If you discover a problem or weak spot, then please report it to us as quickly as possible. Examples of vulnerabilities that need reporting are:

cross-site scripting vulnerabilities
SQL-injection vulnerabilities
encryption weaknesses
What do we expect from you?
Ensure that you do not cause any damage while the detected vulnerability is being investigated. Your investigation must not in any event lead to an interruption of services or lead to any details being made public of either the asset manager or its clients.

What do we do with your report?
A team of security experts investigates your report and responds as quickly as possible. We ask you not to make the problem public, but to share it with one of our experts. Give them the time to solve the problem. We will let you know what our assessment of your report is, whether we will provide a solution and when we plan to do that.

Rules of the game
There is a risk that certain actions during an investigation could be punishable. If you act in good faith, carefully and in line with the rules of the game supplied, there is no reason for Robeco to report you. So follow the rules as stated in these responsible disclosure guidelines and do not act disproportionately:

Do not use social engineering to gain access to a system.
Do not place a backdoor in an information system in order to then demonstrate the vulnerability, as this can lead to further damage and involves unnecessary security risks.
Make as little use as possible of a vulnerability. Only perform actions that are essential to establishing the vulnerability.
Do not edit or delete any data from the system and be as cautious as possible when copying data (if one record is enough to demonstrate the problem, then do not proceed further).
Do not introduce any system changes.
Do not try to repeatedly access the system and do not share the access obtained with others.
Do not use any so-called 'brute force' to gain access to systems. After all, that is not really about vulnerability but about repeatedly trying passwords.
How should you submit a report?
If you have detected a vulnerability, then please contact us using the form below.

What does not need to be reported via the disclosure point?
The disclosure point is not intended for:

submitting complaints about services
making fraud reports and/or suspicions of fraud reports from false mail or phishing e- mails
reporting viruses
submitting complaints or questions about the availability of the website
3
Bug bounty programs / RSK Bug Bounty
« Last post by Angelina on September 20, 2023, 07:24:55 PM »
submit bug report: https://developers.rsk.co/contribute/bug-bounty-program/

Bug Bounty Program
IOVLabs has created this bug bounty program to reward security researchers that dedicate time and effort to improve the IOVLabs platforms.


<< Contribute
4
Bug bounty programs / Onfo Bug Bounty
« Last post by Angelina on September 20, 2023, 07:23:15 PM »
submit bug report: desk.com/help-center-closed/?utm_source=helpcenter-closed&utm_medium=poweredbyzendesk&utm_campaign=text&utm_content=onfo.zendesk.com


Champions of customer service
OUR PRODUCTS
Zendesk for service
Zendesk for sales
Sunshine Platform
Marketplace
Product updates
TOP FEATURES
Ticketing system
Messaging & live chat
Help center
Voice
Community forums
Reporting & analytics
Answer Bot
Customer service software
Ticketing system software
Live chat software
Knowledge base
Forum software
Help desk software
Workforce management
RESOURCES
Security
Product support
Request a demo
Blog
Training
Partners
Webinars
Customer Stories
Services
COMPANY
About us
Newsroom
Investors
Events
Careers
Diversity & Inclusion
Accessibility Plan
Sustainability
Contact us
Sitemap
System status
Zendesk Foundation
Legal
FAVORITE THINGS
What is Zendesk
Zendesk for Enterprise
Zendesk for Small Business
Zendesk for Startups
Zendesk Benchmark
Gartner CRM Magic Quadrant
Customer Experience Trends
What is CRM?
CRM software guide
Join our research panel
5
Bug bounty programs / Notion Bug Bounty
« Last post by Angelina on September 20, 2023, 07:21:40 PM »
submit bug report:https://www.notion.so/Responsible-Disclosure-Policy-5f18bb6b86804eaf989c006131778b9c

# Response Targets

Notion Labs, Inc. will make a best effort to meet the following response targets for hackers participating in our program:

- Time to first response (from report submit) - 3 business days
- Time to triage (from report submit) - 10 business days
- Time to resolution (from report submit) - Varies depending on severity

We’ll try to keep you informed about our progress throughout the process. Feel comfortable reaching out with any questions.

# Disclosure Policy

- As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).

6
Bug bounty programs / Nextcloud Bug Bounty
« Last post by Angelina on September 20, 2023, 07:18:48 PM »
submit bug report: https://nextcloud.com

We're inviting researchers all over the globe to take a look at Nextcloud and bring it's security to the next level. If you're interested in learning how we handle security you can read more about it on our dedicated security page.
Program policy
We know how valuable your time is and employ a "No bullshit policy" that boils down to: Don't be a jerk. Instead of bothering you with a huge list of exclusions we're going to tell you what we're especially looking after:
Bugs within Nextcloud server and apps supported by Nextcloud GmbH (Note: see scope below for all qualifying and packaged components. Third-party apps from the AppStore are not part of our bounty program.)
Bugs within the mobile iOS and Android sync clients
Bugs within the desktop sync clients for Mac, Windows, and Linux
A bug is for us something that actively allows an attacker to escalate their privileges. Something like "Attacker can delete arbitrary files of other users" is fine, "Missing X-Frame-Options on the download servers" not so much. At the moment we are also considering Denial of Service not a reward worthy vulnerability. (we will acknowledge you though!)
Found a security bug in one of the above-mentioned components? Awesome! Just report it here and we will get back to you. These components are also for what monetary rewards are awarded. Bonus points if you check back with our threat model before.
Found a bug in one of our websites or so? While we can't offer you any monetary reward we will acknowledge the issue and happily accept reports for it via this platform as well. But please do not run any Denial of Service attacks against our infrastructure or extract user data. Please do also refrain from using automated testing tools against our infrastructure or disclosing bugs to other parties before we have published a patch.
We believe in transparency about our security, so any valid vulnerabilities discovered are always publicly disclosed after a grace period.
Rewards
Our rewards are based on severity and range up to $10,000. To give you some guidance we have compiled below list:
Impact   Definition   Highest possible reward
Critical   Gaining remote code execution on the server as a non-admin user. (i.e. RCE)   $10,000
High   Gaining access to complete user data of any other user. (i.e. Auth Bypass)   $4,000
Medium   Limited disclosure of user data or attacks granting access to a single users' user session. (i.e. XSS with CSP bypass)   $1,500
Low   Very limited disclosure of user data or attacks involving a very high unlikely amount of user interaction.   $500
Last updated on August 3, 2021.
View changes
Looking for what's in scope? Check out the new Scope tab above.
7
Bug bounty programs / NBX Bug Bounty
« Last post by Angelina on September 20, 2023, 07:13:59 PM »
submit bug report: https://nbxsupport.zendesk.com/hc/en-us/articles/360044264592-NBX-Responsible-Disclosure-Policy

Responsible Disclosure Policy
3 years ago Updated
Information intended for security researchers interested in reporting security vulnerabilities to the NBX security team may see our NBX Responsible Dislosure Policy.

If you are a customer and have a question about security or a password or account issue, please see our Knowledge Base articles or feel free to contact us by opening a support ticket.
8
Bug bounty programs / Myob Bug Bounty
« Last post by Angelina on September 20, 2023, 07:03:16 PM »
submit bug report: https://www.myob.com/au/legal/report-security-vulnerability


Belkin International places a high value on security of its networking products. For many people, their home Wi-Fi router is the only barrier between their home network and a multitude of hostile internet threats intent on taking over their devices.



To protect our user’s privacy and security, Belkin is happy to accept all vulnerability reports that adhere to our coordinated vulnerability disclosure guidelines.

IN SCOPE
Belkin routers, range extenders, keyboards, and other networked devices
Linksys routers, range extenders, Wi-Fi dongles, switches, and other networked devices
WeMo home automation switches, light bulbs, cameras, and other networked devices
NOT IN SCOPE
Any services or systems that are hosted by third party providers or Belkin International owned property, services be it physical or intellectual. This includes and is may not only limited to:



Belkin.com, Linksys.com, and WeMo.com web endpoints
WeMo Cloud
Linksys Smart Wi-Fi web and cloud endpoints
Social Engineering and Phishing attacks against Belkin employees, contractors, customers, or support
9
Bug bounty programs / Belkin Bug Bounty
« Last post by Angelina on September 20, 2023, 07:00:27 PM »
submit bug report: https://www.belkin.com/security-page.html


Belkin International places a high value on security of its networking products. For many people, their home Wi-Fi router is the only barrier between their home network and a multitude of hostile internet threats intent on taking over their devices.



To protect our user’s privacy and security, Belkin is happy to accept all vulnerability reports that adhere to our coordinated vulnerability disclosure guidelines.

IN SCOPE
Belkin routers, range extenders, keyboards, and other networked devices
Linksys routers, range extenders, Wi-Fi dongles, switches, and other networked devices
WeMo home automation switches, light bulbs, cameras, and other networked devices
NOT IN SCOPE
Any services or systems that are hosted by third party providers or Belkin International owned property, services be it physical or intellectual. This includes and is may not only limited to:



Belkin.com, Linksys.com, and WeMo.com web endpoints
WeMo Cloud
Linksys Smart Wi-Fi web and cloud endpoints
Social Engineering and Phishing attacks against Belkin employees, contractors, customers, or support
10
Bug bounty programs / Legal Bug Bounty
« Last post by Angelina on September 20, 2023, 06:59:12 PM »
submit bug report: https://www.lego.com/en-nl/legal/notices-and-policies/responsible-disclosure-policy/?locale=en-nl


Responsible Disclosure Policy
If you believe you have found a security vulnerability in a LEGO® product, please tell us about it.

If you are looking to report a non-security related issue, please use the links below for assistance.

– LEGO® Account. Self-service on https://identity.LEGO.com
– Shop@home, VIP and other problems https://www.LEGO.com/service
– Consumer Service https://www.LEGO.com/service
– Privacy Issues. Contact our privacy officer as described on https://www.LEGO.com/legal/legal-notice/privacy-policy

How to report a security vulnerability to us
If you believe you have found a security vulnerability in one of our web sites or apps, we encourage you to let us know right away. We welcome reports from everyone, including developers, researchers and customers.
To report a security vulnerability, please contact us here and include the following information:

– A URL or an IP address, where you found the issue. When did you find it.
– A description of the issue, including what you saw and what you expected to see.

– A list of steps to reproduce the issue, or a video demonstration if it’s a complicated issue.

How the LEGO Group handles vulnerability disclosure
The LEGO Group will send you an automatic reply to let you know that we received your report, and we’ll contact you if we need more information.

Please note that we do not offer a bug bounty program. This means that the LEGO Group does not pay rewards for disclosed security vulnerabilities.

To protect our customers, we investigate all reported issues, but we do not confirm them publicly.

What we ask of you
• You make a good faith effort to avoid any legal and privacy violations, disruptions to others, including (but not limited to) destruction of data and interruption or degradation of our services.
• You do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.)
• You do not violate any other applicable laws or regulations.
Pages: [1] 2 3 ... 10