AnimeCons.com Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

AnimeCons.com and FanCons.com are literally the same scripts on the same server. AnimeCons.com just filters out any conventions without anime programming...so there's no point to test both AnimeCons.com AND FanCons.com because if there's an issue on one site, it will be an issue on both...and when it's fixed on one, it will be fixed on both.

...so only test FanCons.com and don't even bother testing AnimeCons.com. Don't bother with the .ca or .co.uk TLDs either. They're literally the same site with the same scripts on the same server...just different title images.

Also, don't bother testing the forums either. I didn't write that software and will be turning that forum server off soon anyway. Any forum bug bounties that are logged will just be ignored. Don't waste your time or mine.

Testing Requirements:

Please don't keep slamming the submission forms over and over in attempts to find vulnerabilities. There have been some testers come to the sites (perhaps with good intentions, but maybe looking for vulnerabilities they can exploit themselves) who have submitted garbage data to the site literally THOUSANDS of times. All submitted data gets reviewed by a single human being and NEVER gets auto-posted...which means that one person has to go in and reject all those entries. If you do submit over 100 garbage form entries, don't be shocked if your IP gets blocked. If you send in a ton of garbage, YOU'RE NOT HELPING! One guy did this and then complained about being blocked (seen in reviews below). Again, don't go crazy and you'll be fine. Act like a malicious bot and you'll be blocked like a malicious bot.

...so please, don't keep slamming the submission forms.

Please don't use automated scanners like NexPloit...because that's sure to get you blocked.

Possible Awards:

Sorry, my sites don't bring in a lot of traffic and ad revenue barely pays the server bill. These sites are run by literally ONE guy in his spare time, so I'm unable to offer any monetary rewards of any kind at this time. If you're checking our sites and hoping for a payout, sorry...don't bother.

Special Notes:

If you contact our site claiming to have found some kind of vulnerability that can't be reported here and do not actually tell us the details on the vulnerability, we will treat it as spam or phishing and not respond.