Coordinated and Responsible Vulnerability Disclosure Free Bug Bounty Program 435,954 coordinated disclosures
234,658 fixed vulnerabilities
587 bug bounties with 1184 websites
11,834 researchers, 949 honor badges

CoinLoan Bug Bounty Program

CoinLoan runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of CoinLoan

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between CoinLoan and researchers.

Bug bounty program allow private submissions only.

Bug Bounty Scope

The following websites are within the scope of the program:

*.coinloan.io

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

We at CoinLoan taking the security as the top priority, so we're open for the security researchers from all over the world to test our platform and related websites for security flaws and report them accordingly.

## Out-of-Scope Vulnerabilities
- SSL/TLS configuration issues;
- DDoS/DoS attacks;
- Presence of autocomplete attributes in forms;
- Reports from automated scanners without appropriate analysis or demonstration of security impacts;
- Reports about outdated/vulnerable software without exploitation examples;
- Self-XSS affecting the only current user;
- Missing CSRF token in forms, where sensitive information like user data cannot be modified (e.g. logout form);
- Issues related to window.opener;
- Session hijacking, session timeout;
- Missing security-related HTTP headers which do not lead directly to a vulnerability (CSP, etc.);
- Missing "HttpOnly", "secure", "SameSite" flags for non-sensitive cookies;
- Missing email security DNS records (SPF, DKIM, DMARC);

Testing Requirements:

## Strictly Prohibited
- DDoS/DoS attacks;
- Phishing or other SE attack against regular users;

Possible Awards:

We are reviewing each report individually, so the reward depends on the vulnerability type and its impact. However, we can honestly say that for critical vulnerabilities the reward will be not less than the market average.
The reward can be paid in cryptocurrency or with regular fiat options.

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

Please, send your reports to security [at] coinloan [dot] io

General Requirements:

No special requirements.

Testing Requirements:

No special requirements.

Possible Awards:

Same policy as mentioned above.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 17.09.2019 lifehacker.com.au
 17.09.2019 ucertify.com
 17.09.2019 hancinema.net
 17.09.2019 theweathernetwork.com
 17.09.2019 uihere.com
 17.09.2019 brooksbrothers.com
 17.09.2019 njuskalo.hr
 16.09.2019 jobs2careers.com
 16.09.2019 ctpost.com
 16.09.2019 sheypoor.com

  Latest Blog Posts

13.09.2019 by drok3r
Collection of information | Google Hacking and Dorks basic
09.09.2019 by DakkarKey
New and Powerful XSS scan tool - XSpear
05.09.2019 by MiguelSantareno
Wordpress basic auditing
05.09.2019 by MiguelSantareno
Payloads for all type off web attacks
19.08.2019 by ismailtsdln
IBM - Cross site Scripting [XSS]

  Recent Recommendations

    17 September, 2019
     pacotix:
Thanks a lot for your finding!
    17 September, 2019
     JamieForster:
Thank you for your email advising us of the vulnerability. With your kind help we have fixed the vulnerability.

Your service was very kind and helpful

Kind regards
    15 September, 2019
     dusalnet:
Thank you for find vulnerability for my site.
    15 September, 2019
     eventmanagerOnl:
Dear Rajesh, Thanks for your good support and good communication. We were pleased to meet you.
    14 September, 2019
     dusalnet:
Thank you for research and reporting XSS vulnerability of my site.