Welcome!

We appreciate security researchers and bug hunters who aim to help us keep NowSecure services secure. Your expertise helps us identify vulnerabilities before they can be exploited, and we value your contributions to our security efforts.

Program Scope

We appreciate reports that can help us improve our security posture. Please review the following details carefully before submitting your findings.

In-Scope Assets

• Public Website: https://nowsecure.com
• Publicly Accessible Subdomains: *.nowsecure.com
• Domains/IPs owned by NowSecure

Out-of-Scope Assets

• Any services hosted by third parties, unless they impact the security of our primary assets
• Physical offices and infrastructure
• Employee social media accounts

Vulnerabilities We're Interested In

• Cross-Site Scripting (XSS)
• SQL Injection
• Authentication bypass
• Privilege escalation
• Misconfigured access controls
• Remote Code Execution (RCE)
• Exploitable software dependency

Vulnerabilities Out-of-Scope

• Supporting older TLS versions
• Issues solely affecting outdated browsers
• Missing HTTP security headers
• DMARC/DKIM/SPF configuration
• Vulnerabilities requiring physical access
• Self-XSS requiring significant user interaction
• Reports from automated tools without clear evidence of impact
• Theoretical vulnerabilities without evidence of impact

Rewards

We offer bounties based on the severity and impact of the vulnerability:

• Critical: System compromise or large-scale breach
  E.g. Remote Code Execution (RCE), database access, admin panel access
• High: Access to sensitive data or elevated privileges
  E.g. Privilege escalation, significant data exposure, authentication bypass
• Medium: Other significant vulnerabilities
  E.g.: Cross-Site Scripting (XSS), CSRF, minor API issues

Note: NowSecure will rate any qualifying vulns reported and reward based on severity. Please review the out-of-scope list above and do not submit basic "security misconfiguration", "missing headers" or similar issues. Any issues previously reported/discovered may not be eligible for reward. Reward is contingent on clear report with necessary validation information, and follow-up communications.

Submission Guidelines

• Provide clear, step-by-step instructions to reproduce the vulnerability
• Include screenshots, videos, or code snippets where possible
• Test only on your own accounts; do not access others' data
• Describe the potential impact and attack scenario
• Be respectful of our users' privacy and our systems' stability

Rate Limits & Testing Constraints

• Limit requests to no more than 10 requests per minute
• Avoid testing that triggers excessive emails or notifications (max 5 per hour)
• Limit login/authentication attempts to 10 per hour
• Avoid any testing that could impact system availability or other users (no DoS testing)

Our Commitment

• We will acknowledge your report within 2 business days
• A resolution or update will be provided within 5 business days
• We will keep you informed about the status of your report
• We will recognize your contribution if you wish to be acknowledged

Legal Safe Harbor

This program follows a "safe harbor" approach. As long as your research is conducted responsibly and within the program's scope, we consider it authorized. If legal questions arise, we'll work with you to understand and resolve them.