LetsExchange bug bounty programs

Out of scope 30

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• Assets that do not belong to the company

• Best practices concerns

• Certificates/TLS/SSL-related issues

• Clickjacking/Tapjacking and issues only exploitable through clickjacking/tap jacking

• CSRF in forms that are available to anonymous users (e.g. the contact form)

• Denial of service (DoS/DDoS)

• Descriptive error messages (e.g. Stack Traces, application or server errors)

• DNS issues (i.e. MX records, SPF records, DMARC records etc.)

• Lack of Secure and HTTPOnly cookie flags

• Login & Logout CSRF

• Missing HTTP security headers

• Moderately Sensitive Information Disclosure

• Most brute-forcing issues without clear impact

• Open redirects

• Publicly accessible login panels without proof of exploitation

• Recently (less than 30 days) disclosed 0day vulnerabilities

• Reports that generated by scanners or any automated or active exploit tools

• Reports that state that software is out of date/vulnerable without a proof of concept

• Self-XSS that cannot be used to exploit other users

• Server configuration issues (i.e., open ports, TLS, etc.)

• Session fixation

• Social engineering, phishing, physical, or other fraud activities

• Spam (sms, email, etc)

• Theoretical issues

• User account enumeration

• Username/email enumeration via Login/Forgot Password Page error messages

• Vulnerabilities affecting users of outdated browsers or platforms

• Vulnerabilities in third-party applications

• Vulnerabilities involving active content such as web browser add-ons

• Weak Captcha/Captcha Bypass