Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
746,435 coordinated disclosures
438,120 fixed vulnerabilities
1148 bug bounties with 2,200 websites
20,673 researchers, 1257 honor badges

CoinLoan Bug Bounty Program

CoinLoan runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of CoinLoan

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between CoinLoan and researchers.

Bug bounty program allow private submissions only.

Bug Bounty Scope

The following websites are within the scope of the program:

*.coinloan.io

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

We at CoinLoan taking the security as the top priority, so we're open for the security researchers from all over the world to test our platform and related websites for security flaws and report them accordingly.

## Out-of-Scope Vulnerabilities
- SSL/TLS configuration issues;
- DDoS/DoS attacks;
- Presence of autocomplete attributes in forms;
- Reports from automated scanners without appropriate analysis or demonstration of security impacts;
- Reports about outdated/vulnerable software without exploitation examples;
- Self-XSS affecting the only current user;
- Missing CSRF token in forms, where sensitive information like user data cannot be modified (e.g. logout form);
- Issues related to window.opener;
- Session hijacking, session timeout;
- Missing security-related HTTP headers which do not lead directly to a vulnerability (CSP, etc.);
- Missing "HttpOnly", "secure", "SameSite" flags for non-sensitive cookies;
- Missing email security DNS records (SPF, DKIM, DMARC);

Testing Requirements:

## Strictly Prohibited
- DDoS/DoS attacks;
- Phishing or other SE attack against regular users;

Possible Awards:

We are reviewing each report individually, so the reward depends on the vulnerability type and its impact. However, we can honestly say that for critical vulnerabilities the reward will be not less than the market average.
The reward can be paid in cryptocurrency or with regular fiat options.

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

Please, send your reports to security [at] coinloan [dot] io

General Requirements:

No special requirements.

Testing Requirements:

No special requirements.

Possible Awards:

Same policy as mentioned above.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 22.01.2021 ecu.edu.au
 21.01.2021 liveauction.am
 21.01.2021 esto.nasa.gov
 21.01.2021 french-bookys.org
 21.01.2021 dmm.com
 21.01.2021 polimi.it
 20.01.2021 4gamer.net
 20.01.2021 splunk.com
 20.01.2021 tirebouchon.me
 20.01.2021 rand.org

  Latest Blog Posts

25.12.2020 by _Y000_
How to bypass mod_security (WAF)
10.12.2020 by _Y000_
sql injection to bypass Mod_Security
10.12.2020 by _Y000_
Create encoded sql payloads
26.10.2020 by _r00t1ng_
Bypass Addslashes using Multibyte Character
26.10.2020 by _r00t1ng_
One Payload to Inject them all - MultiQuery Injection

  Recent Recommendations

@hoshitabeman     21 January, 2021
    Twitter hoshitabeman:
It was very helpful for me to point out that I forgot to delete php.info!
@Azatotht     21 January, 2021
    Twitter Azatotht:
Thanks for pointing out a public phpinfo() on our website. A++
@vegasworld     21 January, 2021
    Twitter vegasworld:
Great Job from PRAMOD YADAV. Thanks to his advice we could fix a bug on our Website.
Thanks again!
Best wishes from Germany
@domenico     21 January, 2021
    Twitter domenico:
Thank you Pramod for pointing to the leftover .php file that shouldn't be there.
@seinemaritime     21 January, 2021
    Twitter seinemaritime:
Thank you Pramod for your report. Thank you also for the details in mail ! I recommend him !