FortMesa Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

FortMesa has established a responsible disclosure channel via openbugbounty.org but does not award bounties.

- Please report promptly upon discovery
- This is the official channel and is the only channel that should be used to submit details unless otherwise directed by FortMesa security engineering
- Feel free to contact us via other channels without vulnerability details

Testing Requirements:

Prohibitions:
- High-load fuzzing or other automated scan technology
- Social engineering attacks on FortMesa staff or customers
- Endpoint attacks on FortMesa staff or customers

Notes:
- Limit your data access to the minimum required, do not remove any data from the system
- Stop testing if you encounter user data and report the finding immediately

Possible Awards:

- No monetary awards are possible
- FortMesa policy prohibits monetary awards
- Public thanks via social media or a hall of fame after embargo is happily given

Special Notes:

We would appreciate meaningful attempts to contact us before publishing details, we do not currently require a nondisclosure agreement.

Following disclosure, we ask for a 90 day embargo unless otherwise notified that all impacts have been remediated sooner.