Flitt Bug Bounty¶
General Requirements¶
We assess the criticality of security issues with Common Vulnerability Scoring System v4:
| Severity level | CVSS score |
|---|---|
| None | 0.0 |
| Low | 0.1 – 3.9 |
| Medium | 4.0 – 6.9 |
| High | 7.0 – 8.9 |
| Critical | 9.0 – 10.0 |
As usual practice for rewards programs, we ask you to use common sense when looking for security bugs.
Expect us to eliminate the vulnerability within a reasonable time.
Avoid compromising data of other users and accounts, try to use only your personal or dummy data to search for vulnerabilities.
We do not reward vulnerabilities related to:
- denial of service (DDOS)
- spam or social engineering
- vulnerabilities in third-party applications and services used in Flitt
- software version disclosure
- self-xss
- missing security flags on non-sensitive cookies
- caused a change or damage to the data of real Flitt users
Testing Requirements¶
The list of domains that are participating in the reward program:
*.flitt.com
*.flitt.dev
- we reward only the first person who informed us about the problem
- publicly disclosed problems for which sufficient time has not waited for elimination are not rewarded
- your safety research must not violate the law
Note
Flitt reserves the right to revise the amount of reward depending on the particular case or the circumstances.
Notifications¶
If you think you have found a bug in Flitt security, contact us at email YnVnYm91bnR5QGZsaXR0LmNvbQ== and attach a detailed report on the problem found.
We will respond as quickly as possible to your message.
We ask you not to disclose the problem until it is fixed by Flitt specialists.