Bresser Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

- Provide a clear textual description of the issue along with steps to reproduce it, include attachments such as screenshots or proof of concept code as necessary.
- Avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit yourself about requests per second).
- You must not leak, manipulate, or destroy any user data.

Testing Requirements:

- only use test accounts you control. A Proof of Concept unnecessarily involving accounts of other users or employees may be disqualified
- do not run automated scans without checking with us first.
- do not test the physical security of our offices, employees, equipment, etc
- do not test using social engineering techniques (phishing, vishing, etc.)
- no DoS or DDoS attacks
- in no way attack our end users, or engage in trade of stolen user credentials

Please keep scanner usage to a minimum

Possible Awards:

Recommendation in researchers profile, if reproducible.
We don't have a fixed budget and must decide on case-to-case basis based on severity.