Plausible Analytics bug bounty programs

Out of scope 30

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• 0-day vulnerabilities less than 30/60/90 days from patch release.

• Attacks requiring MITM or physical access to a user’s device

• Clickjacking/UI redressing

• Content spoofing

• CSRF/XSS with long or unpredictable parameter

• Distributed Denial of Service attacks that require large volumes of data.

• Error information disclosure that cannot be used to make a direct attack

• Feedback, comment, message, etc. flooding

• Flash-based vulnerabilities

• Information leakage that cannot be used to make a direct attack, like server IP, server version, path, error message, internal IP, etc.

• Issues related to networking protocols or industry standards

• Local denial of service of Mobile APP

• Login/logout/unauthenticated/low-impact CSRF

• Missing cookie flags

• Missing security-related HTTP headers which do not lead directly to a vulnerability

• Mixed content warnings

• No SPF/DMARC in non-email domains/subdomains

• Physical or social engineering attacks

• PII - do not collect any personally identifiable information - including credit card information, addresses and phone numbers from other customers.

• Provisioning and/or usability issues.

• Reflected file download attacks (RFD)

• Reports from automated tools or scans.

• Security vulnerabilities in third-party products or websites that are not under Plausible Analytics’ direct control.

• Session fixation

• SMS/Email flooding for some of our business

• Social engineering and physical attacks

• SSL/TLS best practices

• Unverified Results of automated tools or scanners

• Violations of licenses or other restrictions applicable to any vendor’s product.

• “Self” XSS