hackerone.com
Open in
urlscan Pro
2606:4700::6810:6334
Public Scan
URL:
https://hackerone.com/fetlife
Submission: On September 13 via api from LU — Scanned from DE
Submission: On September 13 via api from LU — Scanned from DE
Form analysis 0 forms found in the DOM
Text Content
Skip to main content > Hacktivity Opportunities Directory Leaderboard Learn more about HackerOne Log in FETLIFE FetLife is the Social Network for the BDSM, Fetish & Kinky Community. https://fetlife.com Reports resolved 209 Assets in scope 2 Average bounty - Submit report Bug Bounty Program Launched on Jan 2021 * Policy * Scope New! * Hacktivity * Thanks * Updates (0) This program requires two-factor authentication enabled to participate in. Policy MenuMenu No technology is perfect, and FetLife believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly. RESPONSE TARGETS FetLife will make a best effort to meet the following SLAs for hackers participating in our program: Type of ResponseSLA in business daysTime to first response5 daysTime to triage10 daysTime to bounty15 daysTime to resolutiondepends on severity and complexity PROGRAM RULES * Reports must include concrete and clear reproducible steps that do not require any commercial tools * Register all accounts using your <hackerone_username>+x@wearehackerone.com address. * Not interact with other accounts without the explicit consent of their owners. * Communicate with FetLife's engineering team exclusively via HackerOne. * Be the first person to report the issue to us. In cases where you submit a vulnerability that is already acknowledged, we will only award a bounty if it: proves to be more extensive, or provides more information. * If vuln appears to affect multiple domains please include in single report. You will be rewarded correctly as it warrants?? DISCLOSURE POLICY * Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue. * Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party. * Make a good faith effort to avoid privacy violations, destruction of data, interruption or degradation of our service. * Only interact with accounts you own or with the explicit permission of the account holder. BOUNTY REWARD PROGRAM To show our appreciation of responsible security researchers, FetLife offers a monetary bounty for reports of qualifying security vulnerabilities. Vulnerability TypeAverage BountyRemote Code Execution (RCE) on FetLife Servers$6,000SQL Injection (with output)$4,000SQL Injection (blind)$2,000Significant Authentication Bypass$1,500Server Side Request Forgery (SSRF)$1,000Local file Inclusion$500Stored Cross Site Scripting$500Stored Self Cross Site Scripting$150Self Cross Site Scripting$50Sensitive Data Exposure$500Authorization Flaw$500Cross-Site Request Forgery (CSRF)$500Improper Direct Object Reference (IDOR)$500Open Redirect$150Privacy Bugs$100Other$100+ OUT OF SCOPE We do not consider the following to be eligible vulnerabilities under this program: * Denial of Service * Email spoofing * Spamming * Rate-limiting * Click-jacking * Content spoofing * SPF, DMARC or other email configuration related issues * Lack of DNSSEC * SSL configuration issues * Disclosure of server or software version numbers * Generic examples of Host header attacks without evidence of the ability to target a remote victim * Password or account recovery policies, such as reset link expiration or password complexity * Theoretical sub-domain takeovers with no supporting evidence * Perceived security weaknesses without evidence of the ability to target a remote victim. For example credentials are transmitted in POST body as plain text over TLS without demonstrating impact, etc. * Reports exploiting unsupported browsers * False reports, or reports lacking evidence of a vulnerability * Attacks requiring a Man-in-the-Middle, with no other possible exploitation * CSV injection that affects third-party applications * Android Application (https://github.com/fetlife/android) * iOS Application (https://github.com/fetlife/ios * Configuration issues on end users machines. For example password storage or cache settings. DISQUALIFIERS * Interacting with other accounts without the explicit consent of their owners. * Denial of service * Social engineering of any kind * Physical intrusion * Automated scanning and brute-forcing * Requests to /ads/serve, /ads/application_serve*, and /ads/click/* * Overwhelming our support team with messages * Mentioning PHP QUESTIONS * You can contact us with any questions at security@fetlife.com We offer a bounty of up to $5000 for helping us to protect our community. * Last updated on May 19, 2022. * View changes Looking for what's in scope? Check out the new Scope tab above. Response Efficiency 2 days Average time to first response 2 days Average time to triage 21 hrs Average time to bounty 13 days Average time to resolution 100% of reports Meet response standards Based on last 90 days Program Statistics Updated Daily $100 Minimum bounty $44,402 Total bounties paid $500 - $1,000 Top bounty range $700 Bounties paid in the last 90 days 13 Reports received in the last 90 days a month ago Last report resolved 209 Reports resolved 114 Hackers thanked Top hackers balerion Reputation:685 xploiterr Reputation:639 chernobyl Reputation:372 rhinestonecowboy Reputation:311 trieulieuf9 Reputation:274 All Hackers * Opportunities * Security * Leaderboard * Blog * Docs * Support * Disclosure Guidelines * Press * Privacy * Terms * © HackerOne It looks like your JavaScript is disabled. To use HackerOne, enable JavaScript in your browser and refresh this page.