Coordinated and Responsible Vulnerability Disclosure Free Bug Bounty Program 392,037 coordinated disclosures
223,651 fixed vulnerabilities
539 bug bounties with 1058 websites
10,824 researchers, 919 honor badges

Fondy Bug Bounty Program

Fondy runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Fondy

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Fondy and researchers.

Bug bounty program allow all submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

*.fondy.eu

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

We assess the criticality of security issues with Common Vulnerability Scoring System v3 (https://www.first.org/cvss/calculator/3.0):
None 0.0
Low 0.1 – 3.9
Medium 4.0 – 6.9
High 7.0 – 8.9
Critical 9.0 – 10.0

As usual practice for rewards programs, we ask you to use common sense when looking for security bugs. Expect us to eliminate the vulnerability within a reasonable time. Avoid compromising data of other users and accounts, try to use only your personal or dummy data to search for vulnerabilities.

We do not reward vulnerabilities related to:
– denial of service (DDOS)
– spam or social engineering
– vulnerabilities in third-party applications and services used in Fondy
– software version disclosure
– self-xss
– missing security flags on non-sensitive cookies
– caused a change or damage to the data of real Fondy users

Testing Requirements:

The list of domains that are participating in the reward program:
* .fondy.eu
* .fondy.ua
* .fondy.ru
* .cloudipsp.com
* .cipsp.net

As with most security reward programs, there are some limitations:
– we reward only the first person who informed us about the problem
– publicly disclosed problems for which sufficient time has not waited for elimination are not rewarded
– your safety research must not violate the law

Possible Awards:

Bug bounty reward program paused due to the high number of duplicated reports. The program will be restarted after major issues fixed.

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

If you think you have found a bug in Fondy security, contact us at [email protected] and attach a detailed report on the problem found. We will respond as quickly as possible to your message. We ask you not to disclose the problem until it is fixed by Fondy specialists.

PGP Key:

Show key

https://docs.fondy.eu/docs/page/fondy-public-pgp-key/

General Requirements:

We assess the criticality of security issues with Common Vulnerability Scoring System v3 (https://www.first.org/cvss/calculator/3.0):
None 0.0
Low 0.1 – 3.9
Medium 4.0 – 6.9
High 7.0 – 8.9
Critical 9.0 – 10.0

As usual practice for rewards programs, we ask you to use common sense when looking for security bugs. Expect us to eliminate the vulnerability within a reasonable time. Avoid compromising data of other users and accounts, try to use only your personal or dummy data to search for vulnerabilities.

We do not reward vulnerabilities related to:
– denial of service (DDOS)
– spam or social engineering
– vulnerabilities in third-party applications and services used in Fondy
– software version disclosure
– self-xss
– missing security flags on non-sensitive cookies
– caused a change or damage to the data of real Fondy users

Testing Requirements:

The list of domains that are participating in the reward program:
* .fondy.eu
* .fondy.ua
* .fondy.ru
* .cloudipsp.com
* .cipsp.net

As with most security reward programs, there are some limitations:
– we reward only the first person who informed us about the problem
– publicly disclosed problems for which sufficient time has not waited for elimination are not rewarded
– your safety research must not violate the law

Possible Awards:

Bug bounty reward program paused due to the high number of duplicated reports. The program will be restarted after major issues fixed.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

    17 July, 2019
    aqibshah:
@programmanager I have reported a vulnerability via email id. Kindly check it

  Latest Patched

 22.07.2019 alriyadh.com
 22.07.2019 inria.fr
 22.07.2019 wzayef.com
 22.07.2019 coderanch.com
 22.07.2019 actualidadiphone.com
 22.07.2019 careerbuilder.vn
 22.07.2019 molex.com
 22.07.2019 anidb.net
 21.07.2019 panjiva.com
 20.07.2019 fonts2u.com

  Latest Blog Posts

12.06.2019 by Open Bug Bounty
Open Bug Bounty pursues a steady growth in 2019 with over 212,148 fixed vulnerabilities
27.05.2019 by fakessh
bing openredirect
20.05.2019 by fakessh
Hitachi Incident Response Team (HIRT)
11.05.2019 by MAS00712
Footprinting and Reconnaissance with DIRB Tool (For Security Researcher and Bug Bounty Hunters)
01.05.2019 by Renzi25031469
1000's of default passwords on http://open-sez.me

  Recent Recommendations

    22 July, 2019
     shinguz:
A big thank you to Felipe for the vulnerability report of the Cross-Site Scripting (XSS) attacks! The report was detailed enough, with a simple example, to let me quickly verify and fix the issue.
    22 July, 2019
     Zefyx:
A big thanks warbid for your finding !
    22 July, 2019
     PaulAtTheHug:
Warbid found a serious vulnerability in our site and promptly reported it. They also helped verify that our patch had fixed it.
    20 July, 2019
     IbassoI:
Thanks for the vulnerability report! The report was responsible and detailed enough to let us quickly verify and diagnose the issue, understand its impact, and fix it quickly. Ayan was reacting in lightning speed once I contacted him. He explained the issue to me very clear and provided a comprehensive amount of possible solutions. This was really great service, thanks so much!
    19 July, 2019
     nitrc_info:
Thanks for the vulnerability report! The report was responsible (private and without exploiting the vulnerability) and detailed enough to let us quickly verify and diagnose the issue, understand its impact, and fix it quickly.