This is Bugbop's Bug Bounty program, hosted on Bugbop itself!
We’re excited to invite security researchers from all backgrounds to help us make BugBop a more secure platform for everyone.
Program Scope
We appreciate reports that can help us improve our security posture. Please review the following details carefully before submitting your findings.
In-Scope Assets
Out-of-Scope Assets
- Any services hosted by third parties, unless they impact the security of our primary assets
- Denial of Service (DoS) attacks
- Social engineering attacks
Vulnerabilities We’re Interested In
- Cross-Site Scripting (XSS)
- SQL Injection
- Authentication bypass
- Privilege escalation
- Remote Code Execution (RCE)
- Security misconfigurations
- Server-side request forgery (SSRF)
Vulnerabilities Out-of-Scope
- Issues solely affecting outdated browsers
- Missing HTTP security headers (unless they lead to a proven vulnerability)
- Vulnerabilities requiring deep social engineering tactics
- Reports from automated tools without clear evidence of impact
- Any physical attempts against Gleam.io property or data centers
- Vulnerabilities that require access to the user's device or other accounts
- Denial of Service (DoS) attacks
Rate Limits & Testing Constraints
- Limit API requests to no more than 10 requests per minute
- Avoid testing that triggers excessive emails or notifications (max 5 per hour)
- Limit login/authentication attempts to 10 per hour
- Avoid any testing that could impact system availability or other users
Rewards
We offer modest bounties based on the severity and impact of the vulnerability:
- Critical e.g. RCE, database access
- High e.g. privilege escalation, significant data exposure
- Medium e.g. XSS, minor API issues
- Low e.g. information disclosure without direct impact
Note: Reports without clear security implications or that require unrealistic attack scenarios will not be rewarded.
Submission Guidelines
- Provide clear, step-by-step instructions to reproduce the vulnerability.
- Include screenshots, videos, or code snippets where possible.
- Test only on your own accounts; do not access others’ data.
- Be respectful of our users’ privacy and our systems’ stability.
Our Commitment
- We will acknowledge your report within 48 hours.
- A resolution or update will be provided within 10 business days.
Legal Safe Harbor
This program follows a "safe harbor" approach. As long as your research is conducted responsibly and within the program’s scope, we consider it authorized. If legal questions arise, we’ll work with you to understand and resolve them.
