hackerone.com Open in urlscan Pro
2606:4700::6810:6334  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Skip to main content  >

Hacktivity

Opportunities

Directory

Leaderboard

Learn more about HackerOne
Log in




FETLIFE

FetLife is the Social Network for the BDSM, Fetish & Kinky Community.

https://fetlife.com
Reports resolved
209
Assets in scope
2
Average bounty
-
Submit report

Bug Bounty Program
Launched on Jan 2021

 * Policy
 * Scope
   New!
 * Hacktivity
 * Thanks
 * Updates (0)


This program requires two-factor authentication enabled to participate in.
Policy
MenuMenu
No technology is perfect, and FetLife believes that working with skilled
security researchers across the globe is crucial in identifying weaknesses in
any technology. If you believe you've found a security issue in our product or
service, we encourage you to notify us. We welcome working with you to resolve
the issue promptly.


RESPONSE TARGETS

FetLife will make a best effort to meet the following SLAs for hackers
participating in our program:

Type of ResponseSLA in business daysTime to first response5 daysTime to triage10
daysTime to bounty15 daysTime to resolutiondepends on severity and complexity


PROGRAM RULES

 * Reports must include concrete and clear reproducible steps that do not
   require any commercial tools
 * Register all accounts using your <hackerone_username>+x@wearehackerone.com
   address.
 * Not interact with other accounts without the explicit consent of their
   owners.
 * Communicate with FetLife's engineering team exclusively via HackerOne.
 * Be the first person to report the issue to us. In cases where you submit a
   vulnerability that is already acknowledged, we will only award a bounty if
   it: proves to be more extensive, or provides more information.
 * If vuln appears to affect multiple domains please include in single report.
   You will be rewarded correctly as it warrants??


DISCLOSURE POLICY

 * Let us know as soon as possible upon discovery of a potential security issue,
   and we'll make every effort to quickly resolve the issue.
 * Provide us a reasonable amount of time to resolve the issue before any
   disclosure to the public or a third-party.
 * Make a good faith effort to avoid privacy violations, destruction of data,
   interruption or degradation of our service.
 * Only interact with accounts you own or with the explicit permission of the
   account holder.


BOUNTY REWARD PROGRAM

To show our appreciation of responsible security researchers, FetLife offers a
monetary bounty for reports of qualifying security vulnerabilities.

Vulnerability TypeAverage BountyRemote Code Execution (RCE) on FetLife
Servers$6,000SQL Injection (with output)$4,000SQL Injection
(blind)$2,000Significant Authentication Bypass$1,500Server Side Request Forgery
(SSRF)$1,000Local file Inclusion$500Stored Cross Site Scripting$500Stored Self
Cross Site Scripting$150Self Cross Site Scripting$50Sensitive Data
Exposure$500Authorization Flaw$500Cross-Site Request Forgery (CSRF)$500Improper
Direct Object Reference (IDOR)$500Open Redirect$150Privacy Bugs$100Other$100+


OUT OF SCOPE

We do not consider the following to be eligible vulnerabilities under this
program:
 * Denial of Service
 * Email spoofing
 * Spamming
 * Rate-limiting
 * Click-jacking
 * Content spoofing
 * SPF, DMARC or other email configuration related issues
 * Lack of DNSSEC
 * SSL configuration issues
 * Disclosure of server or software version numbers
 * Generic examples of Host header attacks without evidence of the ability to
   target a remote victim
 * Password or account recovery policies, such as reset link expiration or
   password complexity
 * Theoretical sub-domain takeovers with no supporting evidence
 * Perceived security weaknesses without evidence of the ability to target a
   remote victim. For example credentials are transmitted in POST body as plain
   text over TLS without demonstrating impact, etc.
 * Reports exploiting unsupported browsers
 * False reports, or reports lacking evidence of a vulnerability
 * Attacks requiring a Man-in-the-Middle, with no other possible exploitation
 * CSV injection that affects third-party applications
 * Android Application (https://github.com/fetlife/android)
 * iOS Application (https://github.com/fetlife/ios
 * Configuration issues on end users machines. For example password storage or
   cache settings.


DISQUALIFIERS

 * Interacting with other accounts without the explicit consent of their owners.
 * Denial of service
 * Social engineering of any kind
 * Physical intrusion
 * Automated scanning and brute-forcing
 * Requests to /ads/serve, /ads/application_serve*, and /ads/click/*
 * Overwhelming our support team with messages
 * Mentioning PHP


QUESTIONS

 * You can contact us with any questions at security@fetlife.com

We offer a bounty of up to $5000 for helping us to protect our community.
 * Last updated on May 19, 2022.
 * View changes

Looking for what's in scope? Check out the new Scope tab above.
Response Efficiency
2 days
Average time to first response
2 days
Average time to triage
< 1 hr
Average time to bounty
13 days
Average time to resolution
100% of reports
Meet response standards
Based on last 90 days
Program Statistics
Updated Daily
$100
Minimum bounty
$44,302
Total bounties paid
$500 - $1,000
Top bounty range
$600
Bounties paid in the last 90 days
10
Reports received in the last 90 days
25 days ago
Last report resolved
209
Reports resolved
113
Hackers thanked
Top hackers
balerion
Reputation:685
xploiterr
Reputation:639
chernobyl
Reputation:372
rhinestonecowboy
Reputation:311
trieulieuf9
Reputation:274
All Hackers

 * Opportunities
 * Security
 * Leaderboard
 * Blog
 * Docs
 * Support
 * Disclosure Guidelines
 * Press
 * Privacy
 * Terms
 * 

© HackerOne

It looks like your JavaScript is disabled. To use HackerOne, enable JavaScript
in your browser and refresh this page.