VidaXL Holding - Open Bug Bounty Program
Bounty Range
$50 - $2,000
external program
Bounty Range
$50 - $2,000
external program
VidaXL Holding is a company that delivers many services to its customers.
Security is very important to us and this Bug Bounty program shall help us meet highest industry standards to offer the most secure service and experience to all parties.
Everything you can find in relation to the listed domains.
Please adhere to the following rules while performing research on this program:
Denial of service (DoS) attacks on VidaXL Holding applications, servers, networks or infrastructure are strictly forbidden.
Avoid tests that could cause degradation or interruption of our services.
Do not use automated scanners or tools that generate large amount of network traffic
Do not leak, copy, manipulate, or destroy any user data or files in any of our applications/servers.
No vulnerability disclosure, full, partial or otherwise, is allowed.
Make sure to apply hunting requirements policy (User-Agent, VPN...)
In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program's scope and identified outside of our program's scope, such as:
Exposed credentials in/from an out-of-scope asset/source
Sensitive information exposed in/from an out-of-scope asset/source
Also, in order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behavior (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees/service providers.
This excludes, but is not limited to:
Stolen credentials gathered from unidentified sources
Exposed credentials that are not applicable on the program's scope
Exposed GitHub/GitLab (or similar) instance with no direct relation with our program's scope
Exposed secrets (e.g. API tokens/keys or other technical credentials) that are not directly related to the program's scope
Exposed PII on an out-of-scope asset
Policy Summary: Leaks are only eligible if both source and impact are in-scope.
As a complement to the Program's rules and testing policy:
DO NOT alter compromised accounts by creating, deleting or modifying any data
DO NOT use compromised accounts to search for post-auth vulnerabilities (they won't be eligible anyway)
DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII that is part of your PoC (screenshot, server response, JSON file, etc.) as much as possible.
In case of exposed credentials or secrets, limit yourself to verifying the credentials validity
In case of sensitive information leak, DO NOT extract/copy every document or data that is exposed and limit yourself to describe and list what is exposed.
We are happy to thank everyone who submits valid reports which help us improve the security of VidaXL Holding, however only those that meet the following eligibility requirements may receive a monetary reward:
You must be the first reporter of a vulnerability.
The vulnerability must be a qualifying vulnerability
The report must contain the following elements:
Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and VidaXL Holding, and remediation advice on fixing the vulnerability
Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact
Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc
You must not break any of the testing policy rules listed above
You must not be a former or current employee of VidaXL Holding or one of its contractors.
| Asset value | CVSS Low | CVSS Medium | CVSS High | CVSS Critical |
|---|---|---|---|---|
| High | €50 | €250 | €800 | €2,000 |
Reward amounts are based on:
| Scope | Type | Asset value |
|---|---|---|
| https://*.vidaxl.hk | Other | High |
Please append to your user-agent header the following value: -BugBounty-vidaxl-holding-31337
When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.