Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
494,810 coordinated disclosures
270,093 fixed vulnerabilities
668 bug bounties with 1,349 websites
13,770 researchers, 1039 honor badges

NEXUS-IBA Bug Bounty Program

NEXUS-IBA runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of NEXUS-IBA

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between NEXUS-IBA and researchers.

Bug bounty program allow private submissions only.

Bug Bounty Scope

The following websites are within the scope of the program:


Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

No general requirements.

Testing Requirements:

The following test types are not accepted, not allowed and may result in criminal prosecution (*) and (if you are a client, member, volunteer, employee, supplier or user of our services) will also result into immediate suspension or termination of your services:

- Physical testing such as office access (e.g. open doors, tailgating) (*);
- Social engineering (e.g. phishing, vishing, phone calls) agains any NEXUS-IBA member, user, employee, supplier, volunteer or person having an account or using our services;
- Vulnerability reports with video only proof of concepts;
- Reports that state that software is out of date or vulnerable without a proof of concept;
- Highly speculative reports about theoretical damage. Be concrete;
- Vulnerabilities as reported by automated tools without additional analysis as to how they are an issue;
- Any test or access to our services, network or software that may cause any privacy violations, destruction of data, and interruption or degradation of our services (*);
- Issues in third-party services should be reported to the respective teams.

Possible Awards:

As a nonprofit, noncommercial organisation, that is 100% staffed by volunteers we have no financial resources to issue bounties in any monetary amount.

However, upon your consent and at your request, and upon verification of your security findings, we will be glad to mention your name or nickname and optional website link to our Hall of Fame page for any help received in finding and/or solving any security issue related to our products and services. Thank You!

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched


  Latest Blog Posts

20.01.2020 by Rando02355205
XSS on "" (Alibaba WAF 405) Bypassed.
16.01.2020 by Open Bug Bounty
Brief Recap of Open Bug Bounty’s Record Growth in 2019
12.01.2020 by JCQ_47
WAF Cloudflare Bypass XSS at
08.01.2020 by devl00p
Top 100 Open Redirect dorks
08.01.2020 by Rando02355205
XSS WAF Bypassed

  Recent Recommendations

    27 January, 2020
Helped us find and fix a cross site scripting vulnerability. He was very helpful and fast.
    27 January, 2020
Found a cross site scripting vulnerability on our site, was very helpful with fast communication.
    27 January, 2020
haxmov has helped us to find and fix some issues on web sites we're protecting. This kind of help is greatly appreciated from a security perspective. This way we can improve ourselves and protect our customers. Thanks again in my name.
    24 January, 2020
Hi! Thanks for reporting an issue. It has been patched.
    24 January, 2020
Thanks Again.