Openfolio
External Program
Submit bugs directly to this organization
Openfolio
Responsible disclosure includes:
In order to encourage responsible disclosure, we promise not to bring legal action against researchers who point out a problem provided they do their best to follow the above guidelines.
Openfolio reserves the right to decide if the minimum severity threshold is met and whether it was previously reported.
In general, anything which has the potential for financial loss or data breach is of sufficient severity, including:
In general, the following would not meet the threshold for severity:
If you are testing the comment feature, please delete any comments that are not an example of a vulnerability.
If you employ automated scanning tools, their requests must be rate limited to not exceed 2 requests per second without prior approval. Failure to do so may be considered a DoS attack and will result in disqualification from the program.
Automated vulnerability scanners commonly have low priority issues and/or false positives. Before submitting the results from a scanner, please take a moment to confirm that the reported issues are actually valid and exploitable. Please submit an issue only if you have a proof-of-concept (see Scope Exclusions, above)
Thank you for helping keep our community safe