Kommo bug bounty programs

Out of scope 21

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• Attacks designed or likely to degrade, deny, or adversely impact services or user experience (e.g., Denial of Service, Distributed Denial of Service, Brute Force, Password Spraying, Spam...).

• Attacks designed or likely to destroy, corrupt, make unreadable (or attempts therein) data or information that does not belong to you.

• Attacks designed or likely to validate stolen credentials, credential reuse, account takeover (ATO), hijacking, or other credential-based techniques.

• Attacks performed on any systems not explicitly mentioned as authorized and in-scope.

• Attacks related to email servers, email protocols, email security (e.g., SPF, DMARC, DKIM), or email spam.

• Clickjacking or self-XSS reports.

• Domain-based phishing, typosquatting, punycodes, bitflips, or other techniques.

• Email security best practices or controls (e.g. SPF, DKIM, DMARC).

• Intentionally accessing data or information that does not belong to you beyond the minimum viable access necessary to demonstrate the vulnerability.

• Missing cookie flags on non-sensitive cookies.

• Missing HTTP headers (e.g. lack of HSTS).

• Performing physical, social engineering, or electronic attacks against our personnel, offices, wireless networks, or property.

• Reports of how you can learn whether a given client can authenticate to a Kommo product or service.

• Reports of insecure SSL/TLS ciphers (unless accompanied with working proof of concept).

• Reports of mappings between code names and client names.

• Reports of missing “best practices” or other guidelines which do not indicate a security issue.

• Reports of publicly resolvable or accessible DNS records for internal hosts or infrastructure.

• Reports of simple IP or port scanning.

• Security issues or vulnerabilities created or introduced by the reporter (e.g., modifying a library we rely on to include a vulnerability for the sole purpose of receiving a reward).

• Software or infrastructure bannering, fingerprinting, or reconnaissance with no proven vulnerability.

• Violating any laws or breaching any agreements (or any reports of the same).