Bug Bounty Program
Due to an increased volume of invalid reports, we are temporarily suspending our bug bounty program. All reports submitted prior to November 13, 2024, will be reviewed and compensated in accordance with the original agreement.
Please team for further information.
Scope
The program covers our corporate website www.cdn77.com and our customer portal client.cdn77.com.
The primary focus is on identifying and mitigating critical security vulnerabilities, such as:
- Server-Side Request Forgery (SSRF).
- Remote Code Execution (RCE).
- Ability to modify other customer accounts.
- Ability to obtain sensitive information.
- Stored Cross-Site Scripting (XSS) resulting in the ability to obtain or modify customer data.
- Reflected XSS resulting in the ability to obtain or modify customer data.
Out of scope
Certain areas are out of scope. The testing of any vulnerabilities outside the defined scope is strictly prohibited and will result in disqualification from eligibility for legal safe harbor protections.
The following issues are out of scope and will not be considered as security vulnerabilities:
- Clickjacking on pages with no sensitive actions.
- Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms without sensitive actions.
- Attacks requiring man-in-the-middle (MITM) or physical access to a user's device.
- Previously known vulnerable libraries without a working Proof of Concept (PoC).
- CSV injection without demonstrating an actual vulnerability.
- Missing best practices in SSL/TLS configuration.
- Any activity that could result in service disruption, including DoS.
- Content spoofing and text injection issues without an exploitable attack vector.
- Rate limiting or brute force issues on non-authentication endpoints.
- Missing best practices in Content Security Policy (CSP).
- Missing email best practices (e.g., SPF/DKIM/DMARC records).
- Vulnerabilities that only affect users of outdated or unpatched browsers (< 2 stable versions behind).
- Software version disclosure, banner identification issues, or descriptive error messages (e.g., stack traces)
- Cached/stored content of our customers.
- Lack of Security Headers
These are not eligible unless they directly lead to one of the vulnerabilities described in P1–P4.
Taxonomy
This taxonomy defines report severity levels for impactful security vulnerabilities. Cosmetic, best-practice, or informational issues (e.g., missing headers, TLS configs, outdated libraries, etc.) are excluded and not eligible for reward unless they directly lead to exploitability.
P1 - Critical
Direct, full compromise of sensitive data, user accounts, or internal systems without user interaction.
Examples
- Remote Code Execution (RCE)
- SQL Injection with database dump
- Full authentication bypass (login without credentials)
- Critical authorization flaw (read/write to any user's data)
- Unrestricted file upload with execution
- Server-Side Request Forgery (SSRF) that accesses internal systems (e.g., metadata service, admin panels)
Reward
$1,000 – $2,000
(depending on impact and exploitability)
P2 - High
High-impact issues requiring some user interaction or specific conditions; can access/mod user data or escalate privileges.
Examples
- IDOR with access to PII (e.g., invoices, account details)
- Privilege escalation (regular user → admin or staff roles)
- Stored XSS in high-trust contexts (e.g., admin-only UIs)
- 2FA bypass
- Leakage of API tokens, secrets, credentials, servers
- Mass user data scraping via unprotected/rate-unlimited endpoints
Reward
$800 – $1,000
P3 - Medium
Exploitable vulnerabilities with practical impact, but limited scope or conditions required.
Examples
- Reflected or DOM-based XSS with real exploit path
- Open redirect in authentication or redirect chains
- Information disclosure (e.g., error messages with stack trace, internal user IDs)
- CSRF on sensitive but non-critical actions (e.g., email change, setting updates)
- SSRF with external targets only (no access to internal resources)
Reward
$400 – $800
P4 - Low
Low-impact issues with limited harm or no direct security consequence.
Examples
- Unsafe file uploads without execution risk (e.g., missing filetype restriction, no AV)
- Missing security flags on cookies (e.g., HttpOnly, Secure, SameSite)
- Disclosure of internal user IDs, environment names, or non-sensitive metadata.
- Presence of low-privilege test accounts (e.g., test/test) with no access to sensitive data.
Reward
$100 – $400
