Open Bug Bounty selected among the
Top 5 Bug Bounty programs to watch
in 2021 by The Hacker News

For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,003,654 coordinated disclosures
627,136 fixed vulnerabilities
1,348 bug bounty programs, 2,697 websites
23,294 researchers, 1,317 honor badges

Contacts+ Bug Bounty Program

Contacts+ runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Contacts+

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Contacts+ and researchers.

Bug bounty program allow private submissions only.

Bug Bounty Scope

The following websites are within the scope of the program:

contactsplus.com

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

If you are a Security Researcher, please let us know about any security issue and we’ll make every effort to quickly correct it. However you must follow our responsible disclosure policy:

- Disclose the vulnerability and all known details promptly.

- Give us a reasonable time to respond to the issue before making any information about it public in order to protect our users from a possible malicious attack in response to your disclosure. You’re more than welcome to post a write-up after the issue has been fixed and public disclosure has been agreed upon.

- Limit the scope of your activities to Contacts+ properties not those belonging to other services we may use such as analytics providers or support helpdesk. Those issues should be reported to the providers directly. If you’re unsure how to proceed please contact us!

- Clickjacking or other forms of deceit are not in scope for our marketing website (www.contactsplus.com) but are in scope for our web app (app.contactsplus.com).

Testing Requirements:

Please do not run any sort of load testing (e.g. DDoS attacks tests) on any of our assets

Act in good faith not to degrade the performance of our services (including denial of service). We understand accidents may happen.
Strive not to access or modify information in users’ accounts should you find a vulnerability. If necessary, please create a second account to demonstrate the issue. If you cannot, you may report using real accounts.

Possible Awards:

Bounties are assigned entirely at the discretion of the Contacts+’s security team.

Special Notes:

We do not wish to receive reports about the following topics:
1. Possible DoS vulnerabilities
2. Email protections (SPF, DKIM, DMARC)
3. Attackers creating accounts using victim's email address, unless you can show POC for data-leak or account-takeover
4. Clickjacking (and other forms of deceit) are not in scope for our marketing website - www.contactsplus.com, but are in scope for our web app - app.contactsplus.com
5. Ability to view our backend's load-balancer IP address, unless you can demonstrate a valid attack vector using it.

False reports:
1. Password change policy - we WILL ask for re-authentication before changing the password if a certain number of minutes passed since last authentication
2. Wrong password attempts limitation - please test with valid passwords only, invalid password (e.g. short passwords) do not count against the quota
3. CORS attack using a Contacts+ controlled subdomain (e.g. anything.contactsplus.com)
4. Geolocation not stripped from uploaded images
5. Re-authenticate before deleting account - we WILL ask for re-authentication before deleting an account if a certain number of minutes passed since last authentication
6. Session invalidate on password change - Contacts+ will invalidate other sessions, but there might be a few minutes of delay
7. Blog related issues (e.g. seeing blog post authors list)

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

Manojkhd     16 February, 2021
    Manojkhd:
Hi, Contacts+’s security team would like info about other type missing and other type implements for website, so where are reporting. please DM me thank you.

  Latest Patched

 16.06.2021 istat.it
 16.06.2021 infoclimat.fr
 16.06.2021 catalog.library.ks.gov
 15.06.2021 thestreet.com
 15.06.2021 fdj.fr
 15.06.2021 sharethis.com
 15.06.2021 quzhuanpan.com

  Latest Blog Posts

25.05.2021 by 0xrocky
Google XSS Game
25.05.2021 by ShivanshMalik12
Testing for XSS (Cross Site Scripting)
25.05.2021 by darklotuskdb
Easy XSS On Mostly Educational Websites Via Moodle
25.04.2021 by ParanjpeSanmarg
Testing Subdomain Takeover Vulnerability
11.04.2021 by Open Bug Bounty
Better Notifications Mechanism

  Recent Recommendations

@Cyber91998806     16 June, 2021
    Twitter Cyber91998806:
He responded to my mails quickly and helped us how to fix the vulnerability in a professional way. I recommended this guy.
@contactsplus     15 June, 2021
    Twitter contactsplus:
Tuhin reported 3 valid vulnerabilities to us of severities High, Medium and Low.

He was very professional and helped us recreate the issues until we were able to verify.
He was awarded a bounty for his efforts.

Thank you Tuhin!

Contacts+ Security Team.
@infoclimat     15 June, 2021
    Twitter infoclimat:
Auntor has found a misconfigured header that could lead to clickjacking. Thanks for your contribution.
@darione90     14 June, 2021
    Twitter darione90:
Many thanks for finding and reporting an XSS vulnerability on our website!
@darione90     13 June, 2021
    Twitter darione90:
Many thanks for helping us fixing a XSS vulnerability on our website!