Bug Bounty Program

Introduction

Welcome to Pullpo's Bug Bounty Program! We are committed to ensuring the security and integrity of our platform. We believe in the power of collaborative security and invite security researchers, ethical hackers, and IT professionals to help us identify and resolve potential vulnerabilities in our systems.

Program Scope

This bug bounty program covers the following Pullpo assets:

Main website: https://www.pullpo.io
Pullpo web application
Pullpo API endpoints

Out of Scope

The following are considered out of scope for this program:

Third-party services or websites
Physical security vulnerabilities
Social engineering attacks
Denial of Service (DoS) attacks

Vulnerability Types

We are particularly interested in the following types of vulnerabilities:

Remote Code Execution (RCE)
SQL Injection
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
Authentication or Authorization Flaws
Server-Side Request Forgery (SSRF)
Information Disclosure
Business Logic Flaws

Reporting a Vulnerability

To report a vulnerability, please send an email to [email protected] with the following information:

A detailed description of the vulnerability
Steps to reproduce the issue
Proof of Concept (PoC) if applicable
Impact of the vulnerability
Suggested mitigation or fix (if known)

Please allow up to 48 hours for an initial response to your report.

Rewards

Rewards for valid and previously unreported vulnerabilities will range from $0 to $500, depending on the risk and impact of the vulnerability detected. The final reward amount will be determined by our security team based on the following factors:

Severity of the vulnerability
Quality of the report
Potential impact on our users and systems
Complexity of exploitation

Rules and Guidelines

Do not attempt to exploit vulnerabilities beyond what is necessary to demonstrate the issue.
Do not access, modify, or delete data that does not belong to you.
Do not conduct tests that could degrade or disrupt our services.
Keep all information about vulnerabilities confidential until they have been resolved.
Do not share or disclose any information about the vulnerability until we have addressed it and given permission to disclose.

Safe Harbor

We pledge not to pursue legal action against researchers who:

Make a good faith effort to comply with this policy
Do not violate any laws
Do not compromise user privacy or safety

Acknowledgments

We appreciate the efforts of all security researchers who contribute to making Pullpo more secure. With your permission, we will acknowledge your contribution on our security acknowledgments page once the reported issue has been resolved.

Changes to the Program

Pullpo reserves the right to modify or terminate this bug bounty program at any time. Any changes will be reflected in an updated version of this document.

Thank you for helping us keep Pullpo secure!