TRAPEZE Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

The program will last until 31-May-2023.
The companies involved will always provide a response to security researchers, with a timing based on bug severity, and product.
Researchers should always provide a clear description of the vulnerability, attach screenshots, and share links to documentation helping identifying the vulnerability. Reports including brief remediation guidelines will be preferred.

Testing Requirements:

A special focus should be put on data privacy and protection on Personal Identifiable Information (PIIs). Vulnerabilities affecting end-users privacy and PIIs will be prioritized. The main targets are to point out any security vulnerabilities, bugs or flaws in the involved components that could result in a data breach or a violated data usage policy and to ensure that data are shared only with authorized individuals

Possible Awards:

Everyone will receive at least a thank you from the managers of the components involved. gadgets with a maximum value of 100 euros will be distributed to the 10 researchers who will help to discover the vulnerabilities considered most significant by the component managers.

Special Notes:

Vulnerabilities can be disclosed only to the component managers and made public only after the patches are introduced to be eligible to receive an award.