Responsible Disclosure Guidelines

✅ What You Should Do

• Read the program scope carefully

  Each program has specific targets and rules. Only test systems explicitly listed in scope.

• Use your own accounts

  Create test accounts when possible. Never use real customer data or accounts.

• Document everything

  Take screenshots, save HTTP requests/responses, and provide clear reproduction steps.

• Report promptly

  Submit your findings as soon as possible. Don't share vulnerabilities with others before disclosure.

• Be patient

  Allow time for triage and patching. Response times vary by program.

❌ What You Should NOT Do

• Never access non-public data

  Don't view, download, or store customer data or personal information.

• Don't modify or delete data

  Never alter, delete, or corrupt data in any system.

• No Denial of Service attacks

  Don't attempt to overwhelm systems with excessive traffic.

• Don't exploit beyond proof-of-concept

  Stop once you've confirmed the vulnerability. Don't pivot to other systems.

• No social engineering

  Don't attempt to manipulate employees or support staff.

• Don't share vulnerabilities

  Keep findings confidential until disclosed by the program.

Scope Rules

Reward Structure

Submission Process

Legal Protection