Nexus Mods Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

We are interested in hearing about any potential security issues on any Nexus Mods websites, web services, and products. To be eligible for a reward, we typically require the issue report to have some actual security impact in a realistic scenario. That does not mean you need to exploit issues fully. Just provide the information you have, and we will analyse your report and draw conclusions on the impact.

Responsible disclosure is the industry's best practice, and we recommend it as a procedure for anyone researching security vulnerabilities. It gives us a fighting chance to resolve the problem before the criminally-minded attempt to exploit it.

We are happy to thank everyone who submits accurate reports which help us improve the security of our services. However, only those that meet the following eligibility requirements may receive a monetary reward:

* You must be the first reporter of a vulnerability.
* The vulnerability must be a qualifying vulnerability.
* Any weakness found must be reported no later than 24 hours after discovery and exclusively through openbugbounty.org.
* You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
* You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit yourself about requests per second).
* You must not leak, manipulate, or destroy any user data.
* You must not be a former or current employee of Nexus Mods or one of its contractors or any related party or company.
* Reports about vulnerabilities are examined by our security analysts. Our analysis is always based on the worst-case exploitation of the vulnerability, as is the reward we pay.
* No vulnerability disclosure, including partial, is allowed for the moment.

Qualifying Vulnerabilities:
* Cross-Site Scripting (XSS)
* Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
* Authentication and Authorization Flaws
* Cross-Site Request Forgery (CSRF)
* Remote Code Execution (RCE)
* Code injections (HTML, JS, SQL, PHP, etc.)
* Insecure direct object references
* CORS
* Directory Traversal
* Privilege Escalation

Non-Qualifying Vulnerabilities:
* Self XSS
* Missing cookie flags
* SSL/TLS best practices
* Mixed content warnings
* DoS or DDoS attacks
* HTTP Host Header XSS
* Clickjacking/UI redressing
* Software version disclosure
* Stack traces or path disclosure
* Physical or social engineering attempts
* Recently disclosed 0-day vulnerabilities
* Presence of autocomplete attribute on web forms
* Vulnerabilities affecting outdated browsers or platforms
* Issues that require physical access to a victim's computer/device
* Logout and other instances of low-severity Cross-Site Request Forgery
* Missing security-related HTTP headers which do not lead directly to a vulnerability
* Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated
* Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC)

We ask you to abide by the following guidelines:
* Unless Nexus Mods permits you, do not disclose any issues to the public, or any third party.
* Unless Nexus Mods permits you, do not publish any report submitted concerning this program.
* If you have questions on timelines (to remediation, bounty, etc.), please ask directly in the relevant report.

Testing Requirements:

There are some things we explicitly ask you not to do:

* When experimenting, please only attack test accounts you control. A Proof of Concept unnecessarily involving accounts of other end users or our employes may be disqualified.
* Do not run automated scans without checking with us first.
* Do not test the physical security of our offices, employees, equipment, etc.
* Do not test using social engineering techniques (phishing, vishing, etc.)
* Do not perform DoS or DDoS attacks.
* In any way, attack our end users, or engage in trade of stolen user credentials

Possible Awards:

We reserve the right to adjust the bounty amount and change the report's vulnerability level accordingly, as well as not make a payout if, in our opinion, the above criteria have not been met. These bounties are only a guideline.

* Low $50
* Medium $150
* High $300
* Critical $500

Special Notes:

If you have any further questions, please do not hesitate to contact us on [email protected].

Other Submissions Handling