3 Foot Tall Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Please provide a brief summary of the issue, including any URIs or other identifiers as necessary.
For complex issues, a workflow may be required to verify the issue.
A PoC or screenshots are appreciated to diagnose/confirm issues and fixes.
Please do not submit multiple reports for different subdomains if the page is clearly the same.

Testing Requirements:

No social engineering contacts please.
No destructive or damaging test, any deliberate disruption caused to normal operations will forfeit any possibly award and will be reported.
No excessive or repeated scanning.
Please note that excessive scanning or repeated attempts may get auto-blocked and reported as malicious by automated monitoring.
Please be aware that invalid or unauthorised subdomains are resolved to the main website.

Possible Awards:

We will always add a recommendation in the researchers’ profile for all valid reports.
Valid reports may be listed on acknowledgements page, if deemed appropriate,
Financial or gift awards may be awarded where they are seen appropriate for the issue identified. Not all vulnerabilities are eligible for an award, duplicate reports are also ineligible.

Special Notes:

No disclosure of issues identified before a resolution can be implemented.
Issues in third-party libraries or code where no official fix is available are excluded - please report those vulnerabilities to the responsible person for those codebases.
For submissions not appropriate on Open Bug Bounty, please contact us on directly through the contact form on our website.

Other Submissions Handling