Bounties & rewards
As a growing company, we cannot currently commit to a fixed, guaranteed bug bounty budget. We do, however, greatly value your effort and want to recognise good work appropriately.
- Voluntary rewards: For valid, critical vulnerabilities we are happy to award financial bounties, tokens of appreciation (swag) or free use of our platform.
- Paid at our discretion: All rewards are purely voluntary (discretionary bounty). There is no legal entitlement to any payment.
- Criteria: A reward requires that you were the first to report the vulnerability, that it is reproducible and that you followed the rules of this policy.
Rules of engagement
To keep testing safe and responsible, please follow these principles:
- Protect user data: As soon as you come across personal data (PII), payment data or other sensitive information during your tests, stop the test immediately. Access only the absolute minimum of data needed for your proof of concept, and report the finding right away.
- Your own test accounts only: Test exclusively with your own accounts. Accessing other users' data is strictly prohibited.
- No service disruption: Avoid anything that could affect the availability of our services (e.g. DoS/DDoS attacks, spamming or aggressive automated scans).
- Confidentiality: Give us reasonable time to review and fix a reported vulnerability before you publish any information about it (coordinated disclosure). Extortionate demands rule out any cooperation.
Scope
In scope: Our Brandpool at brandpool.spreat.com and our website spreat.com, including its editorial area at /admin.
Out of scope: Third-party services and infrastructure. In addition, purely theoretical deviations from best practice without direct exploitability (e.g. missing email security records such as SPF/DMARC, purely cosmetic clickjacking cases) are not eligible for a reward.
Report a vulnerability
Please send your report with all relevant details (step-by-step instructions, screenshots or a PoC script) by email to security@spreat.com.
We aim to review incoming reports as quickly as possible, confirm receipt and keep you informed while we fix the issue.
Safe harbor
If you carry out your research in good faith and within the scope of this policy, we will:
- consider your activities authorised under the relevant IT security laws and not take legal action against you.
- waive restrictions in our terms and conditions for your security research, insofar as they would conflict with your testing under this policy.
- officially confirm, should third parties ask, that your research was carried out in line with this policy.
Thank you
Thank you for helping us keep our platform secure!