Aiven Ltd
External Program
Submit bugs directly to this organization
Aiven Ltd
Aiven look forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.
Please read through the entire policy and take special care regarding the following:
@wearehackerone.com email address for registering testing accounts. Do not use any other email addresses such as @gmail.com for security testing.Aiven is a next-generation managed cloud database platform as a service. Its focus is in ease of adoption, high fault resilience, customer's peace of mind and advanced features at competitive price points. See https://aiven.io/ for more information.
Please sign up for a free trial account and launch any service from the below list. We are most interested in vulnerabilities in the services and our APIs.
List of Aiven services eligible for bounty and available for testing:
aivencloud.com domain not created by you are explicitly out of scope, as those are our customers' services.@wearehackerone.com email address for registering testing accounts. Do not use any other email addresses such as @gmail.com for security testing.aivencloud.com domain.Aiven offers 30 day free trial on sign-up with reasonable amount of credits.
@wearehackerone.com email address for registering testing accounts. Do not use any other email addresses such as @gmail.com for security testing.[email protected] syntax.Please do note, that if you assign other payment method such as your personal credit card to your account, you're liable for all cost of resources and services consumed. The premium plans might incur significant cost for you. Contact us (through Hackerone support) before researching anything where the charges would exceed trial credits.
Aiven will make a best effort to meet the following SLAs for hackers participating in our program.
| Type of Response | SLA in business days |
|---|---|
| First Response | 2 days |
| Time to Triage | 2 days |
| Time to Bounty | 14 days |
| Time to Resolution | 30 days |
We’ll keep you informed about our progress throughout the process.
Our disclosure policy is open but responsible. Thank you for joining us in supporting ethical disclosure.
Any activities conducted in a manner consistent with this policy will be considered authorised conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. In general we require a demonstrated security vulnerability - a simple usability issues (for example, entering specific, valid data causes server to respond with 500 Internal Server Error, but no other impact is demonstrated) can be reported, but may not result in a bounty even if we end up fixing the issue.
| Vulnerability | Severity Range |
|---|---|
| Remote Code Execution | Critical |
| SQL Injection | High-Critical |
| XXE | High-Critical |
| XSS | Medium-High |
| Server-Side Request Forgery SSRF | Low-Critical |
| Directory Traversal - Local File Inclusion | Medium-High |
| Authentication/Authorization Bypass (Broken Access Control) | Medium-High |
| Privilege Escalation | Medium-High |
| Insecure Direct Object Reference IDOR | Medium-Critical |
| Misconfiguration | Low-High |
| Web Cache Deception | Low-Medium |
| CORS Misconfiguration | Low-Medium |
| CRLF Injection | Low-High |
| Cross Site Request Forgery CSRF | Medium |
| Information Disclosure | Medium (requires POC) |
| Request smuggling | Low-Medium |
| Mixed Content | Low |
| Vulnerability | Description |
|---|---|
| Customer assets | APIs, services that you have set up by yourself in aivencloud.com domain are in scope, but other customers'; services in aivencloud.com are explicitly out of scope. |
| Support chat | Any vulnerability that is related to support chat function at our web page |
| Denial of Service | Any activity that could lead to the disruption of our service (DoS). |
| Public Zero-day | Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis. |
| Rate-limiting | Rate limiting or bruteforce issues of any kind. |
| Brute force | Bruteforcing long, generated tokens over the network. User Enumeration. Password complexity. |
| Clickjacking | Clickjacking on pages with no sensitive actions, or clickjacking that would be prevented if a Content-Security-Policy-Report-Only header on a page were changed to Content-Security-Policy. |
| Security Best Practices | Missing security headers, cookie flags, etc. |
| Email security best practices | Invalid, incomplete or missing email SPF/DKIM/DMARC records. |
| SSL/TLS Best Practices | Missing best practices in SSL/TLS configuration. |
| Information disclosure | Software version disclosure, Banner identification, Descriptive error messages or headers, Stack traces, application or server errors. Errors containing confidential or secret information that can be used to escalate access are in-scope. |
| CSRF | Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions or minimal impact. |
| Content Spoofing | Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS |
| MITM | Attacks requiring man-in-the-middle or physical access to a user's device. |
| Unlikely user interaction | Issues that require unlikely user interaction. For example, requiring user to manually enter crafted content. |
| Outdated browsers | Vulnerabilities only affecting users of outdated or unpatched browsers (less than 2 stable versions behind the latest released stable version). |
| Open redirect | Open redirect - unless an additional security impact can be demonstrated |
| Header Injection | Host header Injection with no impact |
| Social engineering | Social engineering (e.g. phishing, vishing, smishing, tabnabbing) is prohibited. |
| Physical attacks |
Thank you for helping keep Aiven Oy and our users safe!