HostGator LATAM Bug Bounty

Description

We appreciate your efforts and hard work in making the internet (and HostGator LATAM) more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. If you believe you have discovered a vulnerability in our service, we encourage you to report it responsibly through this program. We will review, validate, and address any vulnerabilities in accordance with Bugcrowd’s responsible disclosure guidelines, ensuring prompt responses and appropriate remediation. Good luck and happy hunting! Eligibility You may not participate in this program if you are an employee or family member of an employee, or a current vendor or employee of such vendor of Newfold Digital and any of its subsidiaries. You are also prohibited from participating if you are (i) in a country or territory that is the target of U.S. sanctions (including Cuba, Iran, Syria, North Korea, or the Crimea region of Ukraine), (ii) designated as a Specially Designated National or Blocked Person by the U.S. Department of the Treasury’s Office of Foreign Assets Control or otherwise owned, controlled, or acting on behalf of such a person or entity, or (iii) otherwise a prohibited party under U.S. trade and export control laws. Ratings/Rewards The program relies on CVSS to evaluate impact and determine reward allocations. It is essential to highlight that the priority of a vulnerability might be altered due to following: The severity of the vulnerability (CVSS rating) The likelihood of exploit The impact of exploit Any other factor at our discretion CVSS Score │ VRT Classification 9.0-10.0 │ P1-Critical 7.0-8.9 │ P2-High 4.0-6.9 │ P3-Medium 2.0-3.9 │ P4-Low 0.0-1.9 │ P5-Informational We reserve the right to make any final determination of rating levels for any reported vulnerability.

Targets

Access/Credentials No credentials will be provided for testing. For any areas that allow a signup you may use your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Note: You will not be reimbursed for any charges you may incur during signup or testing. Program Rules Do not create multiple accounts for testing purposes within HostGator LATAM applications and services. Refrain from using brute force techniques to assess API rate limiting or other functionalities. Phishing, vishing, smishing, or any other forms of social engineering are strictly prohibited. Ensure efforts are made to avoid privacy violations, data destruction, and disruption or degradation of service. Only interact with accounts you own or have explicit permission to use. Unblocking restricted accounts is not guaranteed. Requests for review can be submitted through Bugcrowd for consideration by the HostGator LATAM InfoSec team. Testing is only permitted on components directly controlled by our program; third-party assets are excluded. Interacting with real customers or real customer accounts is forbidden. When a vulnerability consists of different parameters but having the same endpoint, please group this together in the same report else will be considered as duplicate. Multiple vulnerabilities caused by one underlying issue will be awarded one bounty (Ex: Centralized vulnerable parameters). Cross-Site Scripting (XSS) attacks are considered at maximum a medium severity. Out of Scope No DMARC, nor SPF Dos/DDos(Rate Limiting) OAuth session token is not invalidated on logout or password change/reset Open redirect vulnerabilities Error messages (e.g. verbose error messages, stack traces, application or server errors, version disclosure) Clickjacking Missing or misconfigured HTTP security header HTTP/DNS cache poisoning Cloudflare related issues Self-XSS reports will not be accepted Broken links hosted on our website Secrets such as API keys or passwords obtained from external aggregation/indexed data sources (e.g., dehashed.com or intelx.io). Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with non-sensitive actions (including logout CSRF) Recently disclosed (<30 days) zero-day vulnerabilities Please do not test chatboxes on the applications, etc. Use of third-party vulnerable components Anti Automation attacks, missing captcha, missing rate limiting, HTTP headers, SSL/TLS configuration and missing Secure flag on cookies are out of scope Any source code disclosure Info.php (without providing an exploitable scenario) Subdomain takeovers Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.

In Scope (in scope)

At HostGator LATAM, we provide comprehensive web hosting solutions tailored to your business needs. With the purchase of our top-tier hosting services, you receive a free domain and email, along with a full suite of features essential for building and maintaining a successful online presence. Our hosting ensures the reliability, scalability, and security required for growing your business. Any subdomain flows (able to clearly showcase the navigation flow) after user authentication to the below listed targets are also in-scope New Focus Area: AI Agents Section VPS Features, specifically the AI-related functionality

Out of Scope (out of scope)

Any asset not explicitly listed in scope above falls outside this program. If you have found a vulnerability on an asset not covered here, we still want to hear from you — please submit it through our Vulnerability Disclosure Program using the links below: Hostgator LATAM Reports submitted through these links will be reviewed by our security team.