At LeaseWeb, we consider the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities present. No technology is perfect, and LeaseWeb believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly.

Disclosure Policy

• Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
• Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

Bounty Program

To show our appreciation of responsible security researchers, LeaseWeb offers a monetary bounty for reports of qualifying security vulnerabilities with a minimum of $50. Reward amounts will vary based upon the severity of the reported vulnerability, and eligibility is at our sole discretion. Rewards will only be paid via HackerOne.

Eligibility

To qualify for a bounty, you must:

• be the first reporter of the vulnerability
• You follow https://hackerone.com/disclosure-guidelines
• You do not access data of other users and solely use your created accounts.
• You may not publicly disclose the vulnerability prior to our resolution.
• You are not an individual on, or residing in any country on, any U.S. sanctions lists.
• You provide a working proof of concept that exploits the security issue

Exclusions

While researching, we'd like to ask you to refrain from:

• Social engineering (including phishing) of LeaseWeb staff or contractors
• Any physical attempts against LeaseWeb property or data centers
• Denial of service
• Login/Logout CSRF
• Self-XSS (we require evidence on how the XSS can be used to attack another LeaseWeb user)
• Miss of rate limits
• Report from automated tools and scans
• Vulnerabilities sending spam or unauthorised messages
• Bugs in 3rd party software
• X-Frame-Options related
• Missing cookie flags on non-sensitive cookies
• Missing security headers which do not lead directly to a vulnerability (unless you deliver a PoC)
• Physical attack on the infrastructure
• DKIM/SPF/DMARC issues (we are aware they are missing and working on resolution)
• XSS-issues on leasewebnoc.com / noc.leaseweb.com
• Version exposure (unless you deliver a PoC of working exploit)
• Directory listing with already public readable content

Thank you for helping keep LeaseWeb and our users safe!