Websavers Inc Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

We value a complete report with full technical details. We must be able to reproduce the vulnerability and clearly demonstrate that it both exists and represents a weakness in our systems.

While we appreciate all types of reports, there needs to be at least one of the following in order to receive a reward:

1. A demonstrable data leak of data which should not be publicly accessible
2. Incontrovertible evidence that the weakness can be exploited to sufficiently detrimental effect to cause obvious problems with our systems. For example simply allowing xml-rpc in WordPress is not a vulnerability unless you can prove that our firewalls are not effectively blocking bruteforce or DoS attacks against it.

Testing Requirements:

Ensure that any vulnerability scanners are rate-limited. Please ensure to provide complete steps to reproduce and details on why you believe it to be a vulnerability.

Please do *not* submit lazy reports, like "your server says it uses this library which is old!" as many libraries either receive backports while keeping their older version number OR have no known vulnerabilities. You must successfully reproduce an attack on that library that satisfies our "General Requirements" for your report to be accepted.

Possible Awards:

Kudos is always guaranteed, while monetary compensation is possible depending on severity of report.

Special Notes:

If you have found a bug in the software at clients.websavers.ca that can only be repaired by modifying the code, and not a web server configuration, you will need to submit it to the WHMCS bug bounty program described here: https://www.whmcs.com/security-bounty-program/

Other Submissions Handling