VobeSoft bug bounty programs

Out of scope 20

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• Any vulnerability obtained through the compromise of a VobeSoft customer, reseller, or employee account

• Banner disclosure on common/public services

• Being an individual on, or residing in any country on, any U.S. sanctions lists

• Clickjacking and issues only exploitable through clickjacking

• Disclosure of known public files or directories (e.g. robots.txt)

• Domains not listed in the target field

• File upload meta-data not being modified or removed (i.e. EXIF data on uploaded images)

• Knowingly posting, transmitting, uploading, linking to, or sending any malware to or from VobeSoft-owned assets or systems

• Missing HTTP security headers, specifically: Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, XContent-Type-Options, and Content-Security-Policy

• Network level Denial of Service (DoS/DDoS) vulnerabilities and resource exhaustion bugs

• Phishing or social engineering of VobeSoft employees, customers, contractors, vendors, or service providers

• Physical attacks against VobeSoft employees and/or offices

• Presence of application or web browser 'autocomplete' or 'save password' functionality

• Pursuing vulnerabilities discovered on VobeSoft-owned assets or systems

• Security bugs in third-party websites that integrate with VobeSoft

• Self-XSS or XSS bugs requiring an unlikely amount of user interaction

• Sending malicious links to people you know

• Vulnerabilities affecting users of outdated or unsupported browsers or platforms

• Vulnerabilities that require a potential victim to install non-standard software or otherwise take active steps to make themselves vulnerable

• Vulnerability reports using automated tools without validation