Infosec Institute

Open Bug Bounty mentioned in the
Top 6 Bug Bounty programs of
2022 by the InfoSec Institute

The Hacker News

Open Bug Bounty named among the
Top 5 Bug Bounty programs of 2021
by The Hacker News

All Open Bug Bounty emails are sent only from domain being digitally signed. All others are fake. Learn more.
For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,469,222 coordinated disclosures
1,099,116 fixed vulnerabilities
1,745 bug bounty programs, 3,462 websites
34,105 researchers, 1,530 honor badges

Contacts+ Bug Bounty Program

Contacts+ runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Contacts+

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Contacts+ and researchers.

Bug bounty program allow private submissions only.

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

If you are a Security Researcher, please let us know about any security issue and we’ll make every effort to quickly correct it. However you must follow our responsible disclosure policy:

- Disclose the vulnerability and all known details promptly.

- Give us a reasonable time to respond to the issue before making any information about it public in order to protect our users from a possible malicious attack in response to your disclosure. You’re more than welcome to post a write-up after the issue has been fixed and public disclosure has been agreed upon.

- Limit the scope of your activities to Contacts+ properties not those belonging to other services we may use such as analytics providers or support helpdesk. Those issues should be reported to the providers directly. If you’re unsure how to proceed please contact us!

- Clickjacking or other forms of deceit are not in scope for our marketing website ( but are in scope for our web app (

Testing Requirements:

Please do not run any sort of load testing (e.g. DDoS attacks tests) on any of our assets

Act in good faith not to degrade the performance of our services (including denial of service). We understand accidents may happen.
Strive not to access or modify information in users’ accounts should you find a vulnerability. If necessary, please create a second account to demonstrate the issue. If you cannot, you may report using real accounts.

Possible Awards:

Bounties are assigned entirely at the discretion of the Contacts+’s security team.

Special Notes:

We do not wish to receive reports about the following topics:
1. Possible DoS vulnerabilities
2. Email protections (SPF, DKIM, DMARC)
3. Attackers creating accounts using victim's email address, unless you can show POC for data-leak or account-takeover
4. Clickjacking (and other forms of deceit) are not in scope for our marketing website -, but are in scope for our web app -
5. Ability to view our backend's load-balancer IP address, unless you can demonstrate a valid attack vector using it.
6. Visibility into specific tools versions we may be using (e.g. nginx version), unless you can demonstrate an attack vector.

False reports:
1. Password change policy - we WILL ask for re-authentication before changing the password if a certain number of minutes passed since last authentication
2. Wrong password attempts limitation - please test with valid passwords only, invalid password (e.g. short passwords) do not count against the quota
3. CORS attack using a Contacts+ controlled subdomain (e.g.
4. Geolocation not stripped from uploaded images
5. Re-authenticate before deleting account - we WILL ask for re-authentication before deleting an account if a certain number of minutes passed since last authentication
6. Session invalidate on password change - Contacts+ will invalidate other sessions, but there might be a few minutes of delay
7. Blog related issues (e.g. seeing blog post authors list)
8. Using Email+password and then using SSO to login to the same account for account takeover - when SSO is used on an existing account for the first time the system will reset the password preventing this scenario
9. Firebase api key can be viewed publicly in our code (please read this:

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

Manojkhd     16 February, 2021
Hi, Contacts+’s security team would like info about other type missing and other type implements for website, so where are reporting. please DM me thank you.

  Latest Patched


  Latest Blog Posts

16.01.2023 by itsvarmakollu
XSS vulnerabilities discovered in ServiceNow - CVE-2022-38463
16.01.2023 by itsvarmakollu
Turning cookie-based XSS into account takeover
08.07.2022 by 4websecurity
CVE 2022-29455 is still affecting millions of Wordpress sites
08.07.2022 by kh4sh3i_
Zabbix - SAML SSO Authentication Bypass
08.07.2022 by FR13ND0x7F
The Time Machine — Weaponizing WaybackUrls for Recon, BugBounties , OSINT, Sensitive Endpoints and what not

  Recent Recommendations

@soela_cs     23 March, 2023
    Twitter soela_cs:
He's a reliable partner in finding and fixing some security issues on our website, and I'm happy to recommend working with him. Thanks for the collaboration!
@TimFenner7     22 March, 2023
    Twitter TimFenner7:
On behalf of LeaseQuery, I wish to extend our gratitude to 4N_CURZE for reporting a vulnerability found on our website. 4N_CURZE was quick to respond and gladly provided all the information he could in order to help mitigate the risk. His efforts to make the internet a safer place is greatly appreciated!
@pagecp31     17 March, 2023
    Twitter pagecp31:
Huge thanks to Rajesh for pointing out an XSS vulnerability that affected several pages in the website I am developing on my free time. It is much appreciated and the report was very clear!
@travelfish     17 March, 2023
    Twitter travelfish:
Thanks for finding the issuing, passing on your find, and the quick reply. Cheers!
@MrMoney84315336     15 March, 2023
    Twitter MrMoney84315336:
Thank you for reporting the issues, good work.