Contacts+ Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

If you are a Security Researcher, please let us know about any security issue and we’ll make every effort to quickly correct it. However you must follow our responsible disclosure policy:

- Disclose the vulnerability and all known details promptly.

- Give us a reasonable time to respond to the issue before making any information about it public in order to protect our users from a possible malicious attack in response to your disclosure. You’re more than welcome to post a write-up after the issue has been fixed and public disclosure has been agreed upon.

- Limit the scope of your activities to Contacts+ properties not those belonging to other services we may use such as analytics providers or support helpdesk. Those issues should be reported to the providers directly. If you’re unsure how to proceed please contact us!

- Clickjacking or other forms of deceit are not in scope for our marketing website (www.contactsplus.com) but are in scope for our web app (app.contactsplus.com).

Testing Requirements:

Please do not run any sort of load testing (e.g. DDoS attacks tests) on any of our assets

Act in good faith not to degrade the performance of our services (including denial of service). We understand accidents may happen.
Strive not to access or modify information in users’ accounts should you find a vulnerability. If necessary, please create a second account to demonstrate the issue. If you cannot, you may report using real accounts.

Possible Awards:

Bounties are assigned entirely at the discretion of the Contacts+’s security team.

Special Notes:

We do not wish to receive reports about the following topics:
1. Possible DoS vulnerabilities
2. Email protections (SPF, DKIM, DMARC)
3. Attackers creating accounts using victim's email address, unless you can show POC for data-leak or account-takeover
4. Clickjacking (and other forms of deceit) are not in scope for our marketing website - www.contactsplus.com, but are in scope for our web app - app.contactsplus.com
5. Ability to view our backend's load-balancer IP address, unless you can demonstrate a valid attack vector using it.
6. Visibility into specific tools versions we may be using (e.g. nginx version), unless you can demonstrate an attack vector.

False reports:
1. Password change policy - we WILL ask for re-authentication before changing the password if a certain number of minutes passed since last authentication
2. Wrong password attempts limitation - please test with valid passwords only, invalid password (e.g. short passwords) do not count against the quota
3. CORS attack using a Contacts+ controlled subdomain (e.g. anything.contactsplus.com)
4. Geolocation not stripped from uploaded images
5. Re-authenticate before deleting account - we WILL ask for re-authentication before deleting an account if a certain number of minutes passed since last authentication
6. Session invalidate on password change - Contacts+ will invalidate other sessions, but there might be a few minutes of delay
7. Blog related issues (e.g. seeing blog post authors list)
8. Using Email+password and then using SSO to login to the same account for account takeover - when SSO is used on an existing account for the first time the system will reset the password preventing this scenario
9. Firebase api key can be viewed publicly in our code (please read this: https://firebase.google.com/docs/projects/api-keys)