OpenBugBounty.org > Bug Bounty List > Travelfish Bug Bounty Program

Travelfish Bug Bounty Program

Travelfish runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Travelfish

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Travelfish and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

travelfish.org

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Please send a working PoC with CVSS score, screenshots (as required), and a brief remediation guideline.

Please do not sign up for an account on the site to undertake further testing. If you want to kick the tires in member-only sections, please drop me a line (by email) and I’ll send you the details of an account you can use for this purpose.

Testing Requirements:

Pease don’t scan the hell out of the site. Thanks.

Please see the above about not signing up for a new account for testing purposes.

Possible Awards:

Recommendation in researcher profile.

Special Notes:

Please do not disclose or discuss any found vulnerabilities.

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

By email please.

General Requirements:

Testing Requirements:

Pease don’t scan the hell out of the site. Thanks.

Please see the above about not signing up for a new account for testing purposes.

Possible Awards:

Recommendation in researcher profile.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

Researcher's comments

15 March, 2023

Samyakt:

Hi Team,
Could you please share your email address, So I will report to other vulnerability other then XSS, Open redirection.

Latest Patched

Recent Recommendations

23 March, 2023

soela_cs:

He's a reliable partner in finding and fixing some security issues on our website, and I'm happy to recommend working with him. Thanks for the collaboration!

22 March, 2023

TimFenner7:

On behalf of LeaseQuery, I wish to extend our gratitude to 4N_CURZE for reporting a vulnerability found on our website. 4N_CURZE was quick to respond and gladly provided all the information he could in order to help mitigate the risk. His efforts to make the internet a safer place is greatly appreciated!

17 March, 2023

pagecp31:

Huge thanks to Rajesh for pointing out an XSS vulnerability that affected several pages in the website I am developing on my free time. It is much appreciated and the report was very clear!

17 March, 2023

travelfish:

Thanks for finding the issuing, passing on your find, and the quick reply. Cheers!