DeskPro

Not accepted

• Descriptive error messages.
• Information disclosure with minimal security impact (e.g. stack traces, path disclosure, directory listings, logs, robots.txt, etc)
• Clickjacking and issues only exploitable through clickjacking that have minimal impact.
• CSRF on forms that are available to anonymous users (e.g. the contact form).
• CSRF with negligible security impact (e.g. adding to favourites).
• Presence of application or web browser 'autocomplete' or 'save password' functionality.
• Lack of Secure and HTTPOnly cookie flags.
• Lack of Security Speedbump when leaving the site.
• Weak or missing captcha / captcha bypass.
• SSL Attacks such as BEAST, BREACH, Renegotiation attack; SSL Forward secrecy not enabled; SSL Insecure cipher suites.
• Missing HTTP security headers (including Anti-MIME-Sniffing header X-Content-Type-Options) that do not lead to a direct exploitation.
• Tab nabbing.
• Brute force, Rate-limiting, Velocity throttling, or other denial of service based issues.
• XSS where only possible by an administrator.
• XSS where only possible by agents with the "can use arbitrary HTML" permission.
• Self-XSS that has no security impact (e.g. injecting HTML into your own RTE editor).
• Reports of third-party libraries without an actual proof-of-concept.
• Paypal / Price parameter tampering (Paypal payments are handled manually by a member of our staff).
• Weak password policy (password policies are controlled by the account administrator, not by us).