Best practices

We encourage everyone that practices responsible disclosure to participate in the program.

To take part, please make sure that you:

  1. abide by our terms of service.
  2. avoid the use of automated testing frameworks.
  3. only perform testing with your own credentials.
  4. include a proof of concept on how the vulnerability could be exploited.
  5. do not disclose any information regarding vulnerabilities until we have a fix in place.

Rewards are given at our discretion depending on the criticality of the vulnerability reported.

Scopes

We’ve defined the scope of the program to exclude some services which are not critical or pose no risk to customer data, or which we consider not suitable for the program at this time.

In Scope

Out of Scope

Have something to report?

We will respond as quickly as possible to all submissions that follow the rules above, and will consider them as part of the bug bounty program.