Selectra Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Our OBB program is closed.
---
Out of scope:
- Disclosure of known public files or directories, (e.g. robots.txt, default web.config, etc..).
- Clickjacking except if there is a real risk for our customers
- User enumeration
- XSRF-TOKEN cookie in httpOnly on Laravel applications

Testing Requirements:

Our OBB program is closed.
---
No special requirements.
Do not exploit issues that could lead to data loss/change.

Possible Awards:

Our OBB program is closed.
---
We evaluate each submission with great attention and offers financial compensation for most of them.

Special Notes:

Our OBB program is closed.
---
All of our infrastructure is hosted on Pantheon, OVH and AWS.
We sometimes have some domain delegation to our partners application, such as confirma.selectra.io. These applications are out the scope of this program.
If you have any doubts that we own the domain in question, drop us an email before to ask.

Other Submissions Handling