Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
734,105 coordinated disclosures
435,731 fixed vulnerabilities
1141 bug bounties with 2,191 websites
20,555 researchers, 1254 honor badges

Fyndex Bounty Bug Bounty Program

Fyndex Bounty runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Fyndex Bounty

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Fyndex Bounty and researchers.

Bug bounty program allow private submissions only.

Bug Bounty Scope

The following websites are within the scope of the program:

fyndexsuisse.com

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

- SSL/TLS configuration issues;
- DDoS/DoS attacks;
- Presence of autocomplete attributes in forms;
- Reports from automated scanners without appropriate analysis or demonstration of security impacts;
- Reports about outdated/vulnerable software without exploitation examples;
- Self-XSS affecting the only current user;
- Missing CSRF token in forms, where sensitive information like user data cannot be modified (e.g. logout form);
- Issues related to window.opener;
- Session hijacking, session timeout;
- Missing security-related HTTP headers which do not lead directly to a vulnerability (CSP, etc.);
- Missing "HttpOnly", "secure", "SameSite" flags for non-sensitive cookies;
- Missing email security DNS records (SPF, DKIM, DMARC);

Testing Requirements:

Strictly Prohibited!!

- DDoS/DoS attacks;
- Phishing or other SE attack against regular users;

Possible Awards:

We are reviewing each report individually, so the reward depends on the vulnerability type and its impact. However, we can honestly say that for critical vulnerabilities the reward will be not less than the market average.
The reward can be paid in cryptocurrency or with regular fiat options (Euro/CHF)

Special Notes:

Please Send your reports to [email protected]

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

Please, send your reports to [email protected]

PGP Key:

Show key

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: BCPG C# v1.6.1.0

mQENBF/9U+kBCACxzm8V39SNEuXW8+MmBmrT3UyX1WkvbOfQLtuantM8SxjKXYL1
4uodJzlG1ckeo2SK72fwMu/4x4QS7ag4ZXnDZ+6TnYoj6fW/X6dpbnKPEq6gfyfj
Hrv2NfqtRYOFc0wqrJkS611soB2z4cu5rdVZgwsN3jc14azwgcCC61LkVfNyLPwl
UXNwgTvQ4mnUbXuvtjrc0eJMHSKOkgWnEYACq7K4GOjWte0kBahI9yf9xvwSfO+9
S/FDcdUHDporkkMKmu4cBUVaHWWEZA34NW080868O7OOqJ/UYHa9K08NYu8O4FD6
5I88w3DLWP+phJLXSlIoKyYDn2TtPzC/rEf9ABEBAAG0FnRlYW12YW5hZGl1bUBn
bWFpbC5jb22JARwEEAECAAYFAl/9U+kACgkQ0J8V9XCnzzKvMggAiKG1QyavvQlh
t5UN8sauzNw+5v82B4L7REKN4Oe9dd+cQQH56oLQ9mnkX/P0acq5t4c8SzfYb+AA
fkO7y4rEGub9FcHw9PfIIOh7Lyx98k8JarloOQhqXy557VjHcp/B2ec2ZNlVicTL
tewLXy+8QodkZ+2eqQZqsnY0CEjIqBXtNGlY5JNsK4Jku3R7LVeAab7pEsjZBpm5
Krq+wuIBEgt8dddhRad5hfhCCFlgMXya2Ud023QqyN9o6PJUhwuWnInRXw5q+Epu
a/WZCPd4ylxiUT1eflt9SZuG0Zgh1Sv2TjipcyMWK5LQYxZ5Ko34i68hjBzOdch4
xBQnZivYZA==
=Wj3M
-----END PGP PUBLIC KEY BLOCK-----

General Requirements:

No special requirements.

Testing Requirements:

No special requirements.

Possible Awards:

Same policy as mentioned above.

Special Notes:

No special requirements.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 16.01.2021 liveinternet.ru
 16.01.2021 kickit.to
 16.01.2021 sante.fr
 16.01.2021 gehaltsvergleich.com
 16.01.2021 qub.ac.uk
 16.01.2021 bostonglobe.com
 16.01.2021 inshallah.com
 16.01.2021 quantcast.com
 15.01.2021 klerk.ru
 14.01.2021 engineering.com

  Latest Blog Posts

25.12.2020 by _Y000_
How to bypass mod_security (WAF)
10.12.2020 by _Y000_
sql injection to bypass Mod_Security
10.12.2020 by _Y000_
Create encoded sql payloads
26.10.2020 by _r00t1ng_
Bypass Addslashes using Multibyte Character
26.10.2020 by _r00t1ng_
One Payload to Inject them all - MultiQuery Injection

  Recent Recommendations

@smiteworks     15 January, 2021
    Twitter smiteworks:
Rajesh was very helpful in providing information and penetration testing on our site. With this information, we were able to harden our infrastructure.
@mhmitu     15 January, 2021
    Twitter mhmitu:
Hi Praveen,
Thanks for the help with the vulnerability. Very fast and friendly contact.
@matrixrewriter     15 January, 2021
    Twitter matrixrewriter:
We had no idea that this vulnerability existed in many PHP-based websites and you kindly reported it to us. Thanks for your help and all the best for your career!
@SilensStudio     14 January, 2021
    Twitter SilensStudio:
Thank you very much for informing us about our access vulnerability! The world needs more good guys like you! A+!
@JoseLev41970568     14 January, 2021
    Twitter JoseLev41970568:
Specialist in web application penetration tester, student and passionate about computer security and ethical hacking.