40 records / Open collection
Public policy summaries with eligibility, advertised rewards, restrictions, and dated scope captures.
40 matching records
Ordinary research is restricted to owned accounts. Privacy violations, destruction, disruption and unauthorized disclosure are prohibited; automation is limited. Local-root scenarios, accepted design limitations and…
Disclosure requires written consent. Social engineering, physical intrusion, denial-of-service and brute force are prohibited. Activity must stop at payment-entry requirements; automation is constrained.
Product-specific plans override general guidance and constrain environments/accounts. AI-assisted findings need human validation. Privacy violations, disruption, social engineering, unapproved customer environments and…
Preserve confidentiality until Apple’s update and advisory; do not harm others’ data or availability. Apple Pay, non-public systems, third-party services, social engineering and unvalidated reports are excluded.
Mainnet testing is prohibited; permitted research is confined to designated test or local environments. Use owned or explicitly authorized accounts/wallets, avoid other users’ data and financial loss, and do not disrupt…
No customer data, others’ repositories, credential validation, automated scanners, social engineering, physical attacks or post-exploitation pivoting. Cloud denial-of-service and low-impact categories are excluded.…
Preserve privacy, data integrity and availability; no disruption, spam or social engineering. Allow remediation before disclosure. Reports may become public after handling and sensitive-content review. Safe harbor is…
Only owned/authorized accounts. Prohibited: disruption, high-volume automation, automated account creation, social engineering, user-data interference, physical attacks and public video hosting.
Use owned test accounts; do not access other users’ private data. No disruption, social engineering, physical intrusion or brute force. Scanner-only reports, unlisted properties and planned-deprecation products are…
Disclosure requires written consent. Disruption, social engineering, physical intrusion and brute force are prohibited; internally known findings count as duplicates.
Protect customer privacy, integrity and availability. Social engineering and disruption are prohibited; automation and researcher identification are constrained. Disclosure requires written consent.
Protect data integrity, privacy and service availability. Disruption and social engineering are prohibited. Intended email behavior, unlikely-interaction findings, third-party services, username enumeration, obsolete…
Protect others’ information; no social engineering, physical attacks, volumetric disruption, spam or excessive automation. Product-specific exclusions apply; coordinate disclosure until a fix is public.
Privacy violations, disruption, unverified automated reports and third-party/customer installations are excluded. A shared mitigation generally receives one award; GitLab determines severity and payment.
Disclosure requires written consent. Spam, social engineering and physical intrusion are prohibited. Generic rules exclude automated scanning/reporting, while human-validated AI assistance is permitted.
Do not access customer programs, environments or data, or unauthorized third-party infrastructure. Encountering sensitive information requires stopping and notifying the program.
Owned/authorized accounts only; no real-customer interaction, multiple accounts, brute force, social engineering, disruption or data damage. Public disclosure is prohibited; safe harbor is conditional.
Others’ data cannot be accessed or retained; accidental exposure requires stopping and reporting. Disclosure needs written consent. Safe harbor excludes third parties.
Activity must cease upon unintended sensitive-data or cross-account access. Disclosure needs written consent; disruption, social engineering, physical intrusion and brute force are prohibited.
Scope includes selected application, API, SDK and supporting services. Unlisted properties, third-party integrations, support interfaces, non-SDK repositories, scan-only results, low-impact findings, denial-of-service…
Intended execution of user-supplied code is not itself a security finding. Unlisted properties and third-party services are excluded. No staff contact through product features, service disruption or persistent public…
Preserve customer data and availability; stop on unauthorized access, report immediately and delete retained data. No social engineering, disruptive automation, unauthorized credential use or post-compromise activity.…
Scope is limited to selected mobile functionality; web applications and embedded web content are excluded. Automated scanners, bulk account creation, disruptive requests, social engineering and third-party application…
Protect privacy and availability, use controlled accounts, report accidental data exposure and delete retained data after notification. Allow reasonable remediation time; no extortion or personal exploitation. Safe…
Low/medium reports generally receive no bounty. Respect privacy, availability and coordinated-disclosure requirements.
Use owned/authorized accounts, protect privacy and availability, and observe monetary limits. Social engineering and disruption are prohibited. Disclosure needs consent; safe harbor is conditional.
Scope covers selected Container Toolkit and CUDA Toolkit components, emphasizing real privilege-boundary impact. Unreleased Container Toolkit builds, theoretical findings and defects lacking security impact are…
User-data access/alteration, operational disruption, harmful automation, social engineering, physical intrusion and denial-of-service are prohibited. Accidental sensitive-data exposure requires stopping, reporting and…
Selected identity, device and access-management products are covered. Okta Classic and Okta Personal are marked out of scope. No automated scanners, denial-of-service, customer-instance access, customer-data effects,…
Use assigned or self-created accounts in the designated staging environment. Avoid shared-setting changes and disruption. Social engineering is prohibited. Public disclosure is prohibited; safe harbor is conditional.
Use only owned or expressly authorized accounts/data; avoid disruption, destruction, social engineering and unrelated third parties. Model-only content issues and intended sandbox behavior generally do not qualify.…
Only explicitly included services qualify. No third-party, physical, social-engineering or disruptive activity, malware, data alteration, exfiltration or persistence. Stop and notify Proton upon finding a vulnerability…
Owned accounts only. Stop on nonpublic-data access and delete retained information. No form automation, social engineering, disruption or third-party evidence hosting. Public disclosure is prohibited.
Disclosure needs written consent. Automation is bounded; disruption, social engineering, physical intrusion and brute force are prohibited.
No unlawful activity, privacy harm, disruption, physical access, spam or social engineering. Premature public or third-party disclosure forfeits eligibility. Unsupported scanner output and compromised-device scenarios…
Disclosure needs written consent. Automation is bounded; disruption, social engineering, physical intrusion and brute force are prohibited.
Reports need human-validated, realistic security impact. Social engineering, physical intrusion and DDoS are prohibited; disclosure requires written consent. Conditional protections cannot authorize third-party systems.
Limit activity to owned or expressly authorized accounts and data. Open-source findings must be reproduced locally, with no active production testing. No social engineering, disruption, persistence or retention of…
Only expressly listed properties qualify. Protect production stability and use owned accounts and transactions; interaction with real members is prohibited. No high-volume scanning, disruption, social engineering or…
Only explicitly covered services qualify. Real-customer interaction and disruption are prohibited; researcher identification is required and expenses are not reimbursed. Shared root causes receive one bounty. Intended…
No records match these filters. Try a broader search or reset the collection.
GitHub snapshot 2026-10-04
53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software
| / | Focus search on this page |
| Ctrl K | Search everything (command palette) |
| 1-9 | Library, Generator, Playbooks, Gadgets, Checklists, Payloads, Bypasses, Utilities, Reports |
| 0 | AI / MCP connector |
| j / k | Move selection down / up |
| Enter | Expand / open selected |
| c | Copy primary command of selected |
| f | Toggle favorite on selected tool |
| Esc | Clear search / close |