Eurofins bug bounty programs

Out of scope 30

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• API keys found in our mobile applications.

• Attacks requiring physical access to a user's device or attacks requiring MITM.

• Certain reports of spam.

• Clickjacking without an impact.

• Comma Separated Values (CSV) injection without demonstrating a vulnerability.

• Content spoofing / reflection / injection (on 404 page, search result page etc.) unless executes code.

• Cookie and logout policies.

• Email enumeration.

• Exposed credentials that are either no longer valid, or do not pose a risk to an in scope asset.

• Forms missing CSRF tokens (we require evidence of actual CSRF vulnerability).

• Hard to exploit SSL/TLS protocol vulnerabilities, missing best practices in SSL/TLS configuration.

• Known-vulnerable library (without evidence of exploitability).

• Login/logout CSRF.

• Low impact host header issues.

• Missing best practices in Content Security Policy.

• Missing email best practices (Invalid, incomplete, or missing SPF/DKIM/DMARC records, etc.).

• Missing http security headers which do not lead to a vulnerability.

• Missing HttpOnly or Secure flags on cookies.

• Open ports which do not lead directly to a vulnerability.

• Open redirect - unless an additional security impact can be demonstrated.

• Password and account recovery policies, such as reset link expiration or password complexity.

• Physical security of Eurofins facilities, employees, equipment, etc.

• Rate limiting or brute-force issues on non-authentication endpoints.

• Reports from automated tools or scans without a working Proof of Concept.

• Software version disclosure / banner identification issues / descriptive error messages or headers (e.g. stack traces, application, or server errors).

• Tabnabbing.

• Testing third-party applications, websites, or services that integrate with or link to Eurofins properties.

• Tests in a manner that would corrupt the operation of Eurofins solutions.

• Vulnerabilities only affecting users of outdated or unpatched browsers and platforms.

• Vulnerabilities which require a jailbroken device.