Perlego Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

- Always send a work PoC
- Attach screenshots and (optionally) video recordings
- Provide brief remediation guidelines
- In principle, any Perlego-owned web service that handles reasonably sensitive user data is
intended to be in scope. This includes virtually all the content in the *.perlego.com domain. Any
vulnerability found in third party services is excluded from the scope.
- Reports from vulnerability scanners without actual PoC are not considered

Testing Requirements:

Any design or implementation issue that substantially affects the confidentiality or integrity of
user data is likely to be in scope for the program. Common examples include:
- Cross-site scripting
- Cross-site request forgery
- Mixed-content script
- Authentication or authorization flaws
- Server-side code execution bugs

Note that the scope of the program is limited to technical vulnerabilities in Perlego-owned
browser extensions, mobile, and web applications; please do not try to sneak into Perlego
offices, attempt phishing attacks against our employees, and so on.

Out of concern for the availability of our services to all users, please do not attempt to carry out
DDoS attacks, leverage black hat SEO techniques, spam people, or do other similarly
questionable things. We also discourage the use of any vulnerability testing tools that
automatically generate very significant volumes of traffic.

Possible Awards:

Rewards for qualifying bugs range from $100 to $1,000+. We are a startup with limited funds
and we cannot afford to pay as much as the larger organisations do for the discovery of such
vulnerabilities.

- Server-side code execution, like Command injection, deserialization bugs, sandbox escapes: $1000+
- Unrestricted file system or database access: $1000+
- Logic flaw bugs leaking or bypassing significant security controls: $100 - $1000
- Execute code on the client: $100 - $1000
- Other valid security vulnerabilities, like CSRF, Clickjacking, Information leak, privilege escalation: $50 - $500

Special Notes:

- You must not disclose or discuss any found vulnerabilities anywhere to be eligible to receive and award
- Your testing must not violate any law, or disrupt or compromise any data that is not your own
-