NextChapter-old Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Qualifying Vulnerabilities:
* Cross Site Scripting (XSS)
* Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
* Authentication and Authorization Flaws
* Cross Site Request Forgery (CSRF)
* Remote Code Execution (RCE)
* Code injections (HTML, JS, SQL, PHP, etc.)
* Insecure direct object references
* CORS
* Directory Traversal
* Privilege Escalation

Non-Qualifying Vulnerabilities:
* Self XSS
* Missing cookie flags
* SSL/TLS best practices
* Mixed content warnings
* DoS or DDoS attacks
* HTTP Host Header XSS
* Clickjacking/UI redressing
* Software version disclosure
* Stack traces or path disclosure
* Physical or social engineering attempts
* Recently disclosed 0-day vulnerabilities
* Presence of autocomplete attribute on web forms
* Vulnerabilities affecting outdated browsers or platforms
* Issues that require physical access to a victim’s computer/device
* Logout and other instances of low-severity Cross-Site Request Forgery
* Missing security-related HTTP headers which do not lead directly to a vulnerability
* Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated
* Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC)

Testing Requirements:

There are some things we explicitly ask you not to do:
* When experimenting, please only attack test accounts you control. A Proof of Concept unnecessarily involving accounts of other end users or united-domains employee may be disqualified.
* Do not run automated scans without checking with us first.
* Do not test the physical security of united-domains offices, employees, equipment, etc.
* Do not test using social engineering techniques (phishing, vishing, et.c.)
* Do not perform DoS or DDoS attacks.
* In any way attack our end users, or engage in trade of stolen user credentials.

Possible Awards:

For confirmed problems recommendation on your profile and hall of fame.

Special Notes:

Safe Harbor is Given