Rules of Participation

01General rules

• ▹The scope of the bug-bounty program is limited to technical vulnerabilities in the company's services. If you run into issues unrelated to security, please contact customer support.
• ▹For a 0-day or 1-day vulnerability whose official patch was released less than a week ago, the reward is paid at the triage team's discretion and considered on a case-by-case basis.

02Testing rules

• ▹Only use your own accounts or accounts of users who have explicitly given their consent. Do not attempt to access other people's accounts or any confidential information.
• ▹While looking for vulnerabilities, avoid breaching the confidentiality, integrity and availability of information in our services.
• ▹Any activity that could harm the company's applications, infrastructure, clients or partners is prohibited. Examples: social engineering, phishing, denial-of-service attacks, physical impact on infrastructure.
• ▹To confirm a vulnerability, use the smallest possible PoC (Proof of Concept). If it could affect other users or system availability, contact us for permission first. Any further exploitation is strictly prohibited.
• ▹Automated scanning must be limited to 5 requests per second.

03Vulnerability disclosure policy

• ▹Disclosing vulnerabilities or sharing any details without written permission from the triage team is prohibited.
• ▹We reserve the right to decline any request to publicly disclose a report.

04Traffic identification

Traffic generated by external security researchers may be classified as malicious. To avoid related issues, add the following HTTP header to all outgoing requests:

05RCE testing policy

Testing of vulnerabilities that may lead to remote code execution must follow this policy. During testing, no actions on the server are allowed except:

• ▹Running the commands ifconfig (ipconfig), hostname, whoami;
• ▹Reading the contents of /etc/passwd and /proc/sys/kernel/hostname (drive:/boot.ini, drive:/install.ini);
• ▹Creating an empty file in the current user's directory.

Any other actions must be agreed with the triage team in advance.

06SQL injection testing policy

Testing of vulnerabilities that may lead to SQL command injection must follow this policy. During testing, no actions on the server are allowed except:

• ▹Retrieving information about the current database (SELECT database()), its version (SELECT @@version), the current user (SELECT user(), SELECT system_user()) or the host name (SELECT @@hostname);
• ▹Retrieving the database schema (SELECT table_schema), the list of tables (SELECT table_name) and column names (SELECT column_name);
• ▹Running mathematical, conversion or logical queries (including SLEEP) without extracting data, other than the items listed above.

Any other actions must be agreed with the triage team in advance.

07File upload and read policy

Testing of vulnerabilities that may lead to arbitrary file read on the server or arbitrary file upload must follow this policy. Prohibited actions when uploading files:

• ▹Changing, modifying, deleting or replacing any files on the server (including system files), except those associated with your account or the account of a user who explicitly consented;
• ▹Uploading files that may cause a denial of service (e.g. very large files);
• ▹Uploading malicious files (e.g. malware or spyware).

If you gain the ability to read arbitrary files on the server, no actions are allowed except reading files such as /etc/passwd and /proc/sys/kernel/hostname (drive:/boot.ini, drive:/install.ini). Any other actions must be agreed with the triage team in advance.