NOS Comunicações S.A.
Vulnerability disclosure program on Self-hosted nos.pt
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
This Responsible Vulnerability Disclosure policy does not in any way constitute a public bug bounty program.
- Response
-
Within 7 days
A response within a maximum of seven days with an evaluation of the reported vulnerability and the estimated timeframe for correction
- Safe harbor
-
Full
By adhering to the rules and procedures described in this policy, no criminal prosecution will be made for facts related to the discovery of the reported vulnerability
- Hall of fame
-
Yes
Recognition of the name/handle of the person that identified the vulnerability and the summary identification through the hall of fame ;
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 2 excluded.
Products and areas 2
- platforms and servers belonging to NOS Comunicações S.A.
- platforms operated by NOS Comunicações S.A.
Out of scope (2)
- Customer platforms
- third-party applications even if they are being used by NOS Comunicações S.A. platforms
Rules
What the policy asks of you, and the bug types it won't reward, quoted from NOS Comunicações S.A.'s policy.
While testing
-
Do not use the information obtained in an abusive manner that may compromise the availability and confidentiality of the information and the integrity of the platform
-
Do not disclose identified vulnerabilities until they have been corrected and express permission has been given by NOS Comunicações S.A. to do so
-
Ensure the privacy of the users
-
Ensure a cooperative and responsible behavior in compliance with the law
-
Use of means and resources that are inadequate or disproportionate for proving identified vulnerabilities
-
The use of physical security tests, use social engineering techniques, human resource exploitation, spam or phishing
-
Use of identified vulnerabilities or errors to access data beyond what is strictly necessary for verification of vulnerabilities
-
Erasure or modification of data
Not accepted
-
Errors related to common HTTP codes
-
Spoofing of content or host header injection
-
Information disclosure through publicly accessible service banners
-
Publicly known files or directories with non-sensitive information (ex.: robots.txt)
-
Non-existence of HTTP security headers (ex.: Strict-Transport-Security;X-Frame-Options;X-XSS-Protezction;X-Content-Type-Options;Content-Security-Policy)
-
SSL Configurations (SSL forward secrecy not enabled;Weak ou insecure cipher suites)
-
SPF, DKIM and DMARC configurations
-
Deprecated software versions without known vulnerabilities
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.