Hussle Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Please provide the following with all reports:
- A description of the vulnerability including the area of the application impacted (ie. brochure site, checkout, user authentication, etc.);
- A brief description of the data exposed or risk posed by the vulnerability;
- A PoC or clear instructions to enable us to reproduce the reported issue to confirm validity.

NB. we do not accept reports for XSS vulnerabilities on the page /extra-gym.

Testing Requirements:

We welcome most forms of testing, including testing on the brochure site, unauthenticated and authenticated testing on the web application, and direct testing on our exposed API endpoints. Automated testing is acceptable, but please explore the results of automated testing tools to further understand the vulnerabilities reported before submitting as generic reports from automated tools are unlikely to qualify for our rewards scheme.

Please be mindful when using automated testing tools which may generate unexpectedly high volumes of traffic.

Possible Awards:

We operate a bounty program with rewards up to £2,000 for major security issues leading to personal information leakage, or high-risk business threat. Payment is at our discretion and operates on a sliding scale based on severity, prior knowledge and urgency.

We're always happy to provide recommendations to researchers who uncover previously unknown vulnerabilities in our app or APIs.