Al Imran Technical Services Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

- Always include a working proof-of-concept (PoC) with a CVSS score that indicates the severity and impact of the issue.
- Attach screenshots that illustrate the steps and outcomes of your PoC. Screenshots can help us confirm and understand the issue more easily and quickly.
- Provide brief remediation guidelines that propose how to fix or mitigate the issue.

Testing Requirements:

- Do not test on any domains or subdomains other than the ones we have explicitly authorized for testing.
- Do not test on any live or production systems or data.
- Do not test for any vulnerabilities that could result in denial-of-service, such as SYN floods, HTTP floods, or buffer overflows.
- Do not test for any vulnerabilities that could involve accessing, modifying, or deleting any data that does not belong to you, such as customer information, user accounts, or payment details.
- Do not test for any vulnerabilities that could require social engineering, such as phishing, vishing, or impersonation.

Possible Awards:

- A personalized thank-you letter from our CEO, acknowledging your contribution and expressing our appreciation.
- A certificate of recognition, signed by our security team, validating your skills and expertise.
- A free subscription to our premium services, giving you access to exclusive features and benefits for a limited time.
- A shout-out on our social media platforms, highlighting your achievement and promoting your profile to our followers and customers.
- An invitation to join our security hall of fame

Special Notes:

- You need to be the first person to report the vulnerability to us. We will not reward duplicate or previously known issues.
- You need to follow our vulnerability disclosure program guidelines and testing requirements. We will not reward any reports that violate our policies or cause any harm or disruption to our systems, customers, or users.
- You need to provide us with a valid email address and a preferred method of contact. We will use this information to communicate with you and deliver your awards.
- You need to agree to our terms and conditions and sign a non-disclosure agreement. We will not reward any reports that are disclosed to anyone else without our permission or consent.