NEXUS-IBA Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

No general requirements.

Testing Requirements:

The following test types are not accepted, not allowed and may result in criminal prosecution (*) and (if you are a client, member, volunteer, employee, supplier or user of our services) will also result into immediate suspension or termination of your services:

- Physical testing such as office access (e.g. open doors, tailgating) (*);
- Social engineering (e.g. phishing, vishing, phone calls) agains any NEXUS-IBA member, user, employee, supplier, volunteer or person having an account or using our services;
- Vulnerability reports with video only proof of concepts;
- Reports that state that software is out of date or vulnerable without a proof of concept;
- Highly speculative reports about theoretical damage. Be concrete;
- Vulnerabilities as reported by automated tools without additional analysis as to how they are an issue;
- Any test or access to our services, network or software that may cause any privacy violations, destruction of data, and interruption or degradation of our services (*);
- Issues in third-party services should be reported to the respective teams.

Possible Awards:

As a nonprofit, noncommercial organisation, that is 100% staffed by volunteers we have no financial resources to issue bounties in any monetary amount.

However, upon your consent and at your request, and upon verification of your security findings, we will be glad to mention your name or nickname and optional website link to our Hall of Fame page for any help received in finding and/or solving any security issue related to our products and services. Thank You!