Shared Hosting for Everyone, imagined by developers, for developers.Discovering the Public Cloud
We believe that no technology is perfect and that working with skilled security researchers is crucial to identify weaknesses in our technology. If you believe you’ve found a security bug in our service, we are happy to work with you to resolve the issue promptly and ensure you are fairly rewarded for your discovery.
Let us know as soon as possible upon discovery of a potential security issue, and we’ll make every effort to quickly resolve the issue. Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
Test vulnerabilities only against accounts that you own or accounts that you have permission from the account holder to test against.
Never use a finding to compromise/ex-filtrate data or pivot to other systems. Use a proof of concept only to demonstrate an issue.
If sensitive information — such as personal information, credentials, etc. — is accessed as part of a vulnerability, it must not be saved, stored, transferred, or otherwise accessed after initial discovery. All sensitive information must be returned to alwaysdata and any copies of such information must not be retained.
Any type of denial of service (DDoS) attacks is strictly prohibited, as well as any interference with network equipment and alwaysdata infrastructure.
Do not try to over exploit the bug and access internal data for further vulnerabilities. We will determine the severity and reward accordingly.
If you find the same vulnerability several times, please create only one report and eventually use comments. You’ll be rewarded accordingly to your findings.
Violation of any of these rules can result in ineligibility for a bounty and/or removal from the program.
We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy. We consider activities conducted consistent with this policy to constitute “authorized” conduct. We will not bring a claim against you for circumventing the technological measures we have used to protect the applications in scope of this program.
If legal action is initiated by a third party against you and you have complied with this security policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
It is also important to note, we will not take legal action against you simply for providing us with a proof of concept of the security vulnerability. Please follow the guidelines listed in the Proof of concepts section below to ensure that your proof of concept is detailed enough to demonstrate the issue and still follows the guideline listed above.
The research scope only include following addresses:
Vulnerabilities reported on other services or applications will not be addressed.
Provide your IP address in the bug report. We will keep this data private and only use it to review logs related to your testing activity.
Include a custom HTTP header in all your traffic. Burp and other proxies allow the easy automatic addition of headers to all outbound requests. Report to us what header you set so we can identify it easily. For instance:
When testing for a bug, please also keep in mind:
id, hostname, pwd
Minimize the mayhem. Adhere to program rules at all times. Do not use automated scanners/tools — these tools include payloads that could trigger state changes or damage production systems and/or data.
Before causing damage or potential damage: stop, report what you’ve found and request additional testing permission.
Reports about vulnerabilities are examined by our security analysts. If you need to encrypt payload, we strongly recommend you to use the 0xDFDD2138A363986B GPG public key. Reports must be submitted using our bug tracking interface.
Any report sent by email or through our support interface will be rejected.
Our analysis is always based on worst case exploitation of the vulnerability, as is the reward we pay.
We are continuously working to evolve our bug bounty program. We aim to respond to incoming submissions as quickly as possible and make every effort to have bugs fixed within 10 days of being triaged. Rewards will be paid when patch is applied.
We provide cash rewards. Our minimum reward is €50.
The following is merely an indicator of rewards, but does not reflect what the final decision might be. We value quality reports and proofs of concepts.
|Examples of vulnerabilities (non-comprehensive list)
|Accessing restricted parts of third-party elements or their plugins (blog, forum, etc.)
|0.1 - 3.9
|Up to €50
|Accessing permissions/config on users account w/o accessing their content
|4.0 - 6.9
|Up to €200
|Accessing customers data/informations
|7.0 - 8.9
|Up to €350
|Accessing in read or read-write mode to the core platform architecture
|9.0 - 10.0
|Up to €500
We are happy to thank everyone who submits valid reports which help us improve the security of alwaysdata. However, only those that meet the following eligibility requirements may receive a monetary reward:
No vulnerability disclosure, including partial, is allowed before the patch is applied and we agree the publication.
alert(document.domain) should suffice.
http://example.com if possible.
The following list includes vulnerability reports not accepted by our services:
.alwaysdata.net are linked to our customers' accounts. Their flaws are beyond our control;
/tmp directory is a shared directory;
lastname, phone number, email, physical address, physical id copy ↩︎