Rewind

Not accepted

• Denial of service, rate-limiting attacks or other forms of resource exhaustion
• Social engineering of Rewind employees or contractors
• Social engineering attacks against customers without a technical component
• Physical attempts against Rewind property
• Attacks requiring physical access to a user’s device
• Missing cookie flags on non-sensitive cookies.
• Descriptive error messages, such as stack traces or application and server errors, unless they include customer or business data
• IP/Port Scanning via Rewind services unless you are able to hit private IPs or Rewind servers
• CORS issues discovered in our marketing websites that do not affect endpoints that reveal sensitive information, such as public posts
• Issues with SPF, DKIM, DMARC records
• CSRF with minimal impact, such as login/logout CSRF
• Lack of CSRF tokens without demonstrable impact
• Missing best practices, such as missing security headers
• Vulnerabilities and reports from automated scanners without demonstrable impact
• Clickjacking of pages that do not lead to sensitive actions, such as account modification
• Content spoofing with minimal impact, such as non-HTML text injection
• Host header injection without demonstrable impact
• Insecure SSL/TLS ciphers without demonstrable impact
• Account policies, such as email verification, password complexity or reset link expiration
• User enumeration
• Vulnerabilities affecting out-of-date browsers and platforms
• Use of libraries with known vulnerabilities without demonstrable impact
• Use of Rewind for spamming, such as lack of rate limiting for emails
• Hyperlink injection or any link injection in emails sent by Rewind
• Non-sensitive key disclosures (AWS Access Keys in S3 signed URLs, New Relic browser license keys, etc.)