Quantstamp bug bounty programs

Out of scope 20

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• Account/e-mail enumeration using brute-force attacks

• Any low impact issues related to session management (i.e. concurrent sessions, session expiration, password reset/change logout, etc.)

• Bypassing content restrictions in uploading a file without proving the file was received

• Clickjacking/UI redressing

• DDoS

• Google docs, outdated references, repository links, etc. referenced from static PDFs hosted on certificate.quantstamp.com

• Incomplete or missing SPF/DMARC/DKIM records

• Issues related to password/credential strength, length, lock outs, or lack of brute-force/rate limiting protections

• Lack of SSL or Mixed content

• Missing Cookie flags

• No Strict Transport Security (HSTS) headers set.

• Reflected file download attacks (RFD)

• Self-exploitation (i.e. password reset links or cookie reuse)

• Social Engineering attacks

• URL Redirection

• Use of a known-vulnerable library which leads to a low-impact vulnerability (i.e. jQuery outdated version leads to low impact XSS)

• Use of automated vulnerability / scanning tools

• Vulnerabilities affecting users of outdated browsers, plugins or platforms

• Vulnerabilities that allow for the injection of arbitrary text without allowing for hyperlinks, HTML, or JavaScript code to be injected

• Vulnerabilities that require the user/victim to perform extremely unlikely actions (i.e. Self-XSS)