alwaysdata and its subsidiaries constitute a hosting provider that offer a PaaS solution for everyone since 2006, but is particularly focused on developers everyday-use.
alwaysdata's platform is designed to host hundreds of accounts on each server. Each account get a full access to all wanted interpreters, various databases, email accounts, brokers (for VPS and Dedicated servers), backups, various remote access, an API to control settings, etc. Each account can host as many websites as wanted.
We believe that no technology is perfect and that working with skilled security researchers is crucial to identify weaknesses in our technology. If you believe you've found a security bug in our service, we are happy to work with you to resolve the issue promptly and ensure you are fairly rewarded for your discovery.
Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue. Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
Test vulnerabilities only against accounts that you own or accounts that you have permission from the account holder to test against.
Never use a finding to compromise/exfiltrate data or pivot to other systems. Use a proof of concept only to demonstrate an issue.
If sensitive information -- such as personal information, credentials, etc. -- is accessed as part of a vulnerability, it must not be saved, stored, transferred, or otherwise accessed after initial discovery. All sensitive information must be returned to alwaysdata and any copies of such information must not be retained.
Any type of denial of service (DDoS) attacks is strictly forbidden, as well as any interference with network equipment and alwaysdata infrastructure.
Do not try to over exploit the bug and access internal data for further vulnerabilities. We will determine the severity and reward accordingly.
If you find the same vulnerability several times, please create only one report and eventually use comments. You'll be rewarded accordingly to your findings.
Violation of any of these rules can result in ineligibility for a bounty and/or removal from the program.
We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy. We consider activities conducted consistent with this policy to constitute “authorised” conduct. We will not bring a claim against you for circumventing the technological measures we have used to protect the applications in scope of this program.
If legal action is initiated by a third party against you and you have complied with this security policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
It is also important to note, we will not take legal action against you simply for providing us with a proof of concept of the security vulnerability. Please follow the guidelines listed in the Proof of concepts section below to ensure that your proof of concept is detailed enough to demonstrate the issue and still follows the guideline listed above.
Vulnerabilities reported on other services or applications are not allowed.
Provide your IP address in the bug report. We will keep this data private and only use it to review logs related to your testing activity.
Include a custom HTTP header in all your traffic. Burp and other proxies allow the easy automatic addition of headers to all outbound requests. Report to us what header you set so we can identify it easily. For instance:
When testing for a bug, please also keep in mind:
Minimize the mayhem. Adhere to program rules at all times. Do not use automated scanners/tools - these tools include payloads that could trigger state changes or damage production systems and/or data.
Before causing damage or potential damage: Stop, report what you've found and request additional testing permission.
We'll be pleased to credit you in our HoF at /en/transparency/ for your reports until patches are applied.
We mention our security partnerships on our social networks accounts (e.g. https://twitter.com/alwaysdata).
If you report critical vulnerabilities, we'll be pleased to interview you as a security researcher, and publish the interview in our blog at https://blog.alwaysdata.com/.
We offer t-shirts, swag stuff and/or vouchers as rewards for validated reports.
Our minimum reward is 50 Euros.
The following is merely an indicator of rewards, but does not reflect what the final decision might be. _We value quality reports and proofs of concepts._
| Qualification | Score CVSS | Bounty |
|---|---|---|
| None | N/A | No Bounty |
| Low | 0.1 - 3.9 | <= 50 € |
| Medium | 4.0 - 6.9 | <= 200 € |
| High | 7.0 - 8.9 | <= 350 € |
| Critical | 9.0 - 10.0 | <= 500 € |
We are happy to thank everyone who submits valid reports which help us improve the security of alwaysdata. However, only those that meet the following eligibility requirements may receive a monetary reward:
Reports about vulnerabilities are examined by our security analysts. If you need to encrypt payload, we strongly recommend you to use the 0x53EC46DAA71D9A1A GPG public key available on hkps://hkps.pool.sks-keyservers.net. Reports must be submitted using our ticketing interface available at https://admin.alwaysdata.com/support/. Please do not report directly by email.
Our analysis is always based on worst case exploitation of the vulnerability, as is the reward we pay.
Time to first response: 2 business days or less.
Time to triage: 3 business days or less.We are continuously working to evolve our bug bounty program. We aim to respond to incoming submissions as quickly as possible and make every effort to have bugs fixed within 10 days of being triaged. Rewards will be paid when patch is applied.
No vulnerability disclosure, including partial, is allowed before the patch is applied and we agree the publication.