Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
541,054 coordinated disclosures
348,095 fixed vulnerabilities
814 bug bounties with 1,591 websites
16,682 researchers, 1134 honor badges

Centauri Bug Bounty Program

Centauri runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Centauri

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Centauri and researchers.

Bug bounty program allow private submissions only.

Bug Bounty Scope

The following websites are within the scope of the program:

centauricorp.com

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Out-of-scope vulnerabilities:
- Reports from automated scanners without appropriate analysis or demonstration of security impacts
- Reports about outdated/vulnerable software without exploitation examples
- Self-XSS affecting only current user
- Missing CSRF token in forms, where sensitive information like user data cannot be modified (e.g. logout form)
- Issues related to window.opener
- Session hijacking, session timeout
- Missing security HTTP headers (X-Frame-*, X-Content-*, CSP, HSTS, HPKP)
- Missing SPF, DKIM, DMARC records
- Missing "HttpOnly", "secure", "SameSite" flags for non-sensitive cookies
- Possibilities for exhaustive search by user/item identifiers

Testing Requirements:

If possible, please provide us with full test scenario and how to reproduce the issue.
Strictly prohibited:
- Searching for vulnerabilities in out-of-scope and 3rd-party services. This includes payment gateways.
- DoS/DDoS/physical access/phishing/social engineering attacks.
- Stealing regular users' accounts and performing any other actions affecting their security.
- Publishing any sensitive information discovered during security testing.

Possible Awards:

At this time, Centauri Corp does not have any active reward program for reported vulnerabilities.

Special Notes:

We prefer that you contact us via [email protected]

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 08.07.2020 jimms.fi
 08.07.2020 daniweb.com
 07.07.2020 wikizero.com
 07.07.2020 kayqer.am
 06.07.2020 wirtualnemedia.pl
 06.07.2020 kpl.gov
 05.07.2020 arise.com
 05.07.2020 ica.se
 05.07.2020 oxtorrent.com
 05.07.2020 mrshabanali.com

  Latest Blog Posts

24.06.2020 by Gkexamquiz
How to Find Contacts To Report Bugs & Security Vulnerabilities | Bug Bounty Tutorials 2020
24.06.2020 by 0xcrypto
Improper Access Control - Generic: Unrestricted access to any "connected pack" on docs in coda.io
04.04.2020 by Rando02355205
(Alibaba) message.alibaba.com [IDOR] - [Bug Bounty]
12.03.2020 by Rando02355205
(Paypal) www.paypal.com [CSP High Level] - [XSS Reflected] - [Bug Bounty] - [Write Up]
08.03.2020 by CybeReports
JDECO.net XSS Vulnerability| CybeReports

  Recent Recommendations

    8 July, 2020
     baladulan:
Armin, vielen Dank für deine Unterstützung!
    6 July, 2020
     aldraHastur:
Vielen Dank für den Hinweis, mit dem wir eine Lücke im System schließen konnten.
    4 July, 2020
     TadeuszWiew:
Thank you for finding and reporting the vulnerability on our website.
Great job! :)
    2 July, 2020
     booksprice:
Thank you for reporting the bug, and the clear details, much appreciated.
    1 July, 2020
     matthews8000:
Manish has correctly identified a vulnerability and suggested an appropriate fix. This has lead to an improvement in the security of the website.