Water-Link Vulnerability Disclosure Program
Description
At Water-link, we build with precision and defend with purpose—but we know the real edge comes from those who operate outside the perimeter. You spot the cracks before they become breaches. You think in payloads, not platitudes. And that's exactly why your work matters.
Your ability to uncover vulnerabilities and help us patch them doesn't just harden our systems—it raises the bar for security across the entire web. You're not just contributors; you're catalysts. We see the time you invest, the skill you bring, and the mindset that drives it all. And we respect the hell out of it. Let's keep pushing boundaries together.
Please note that we will not be paying bounties for this VDP - if a bounty is what you're after, our public program is for you!
Stay curious. Stay dangerous (to bugs, that is) 😉
Bounties
This is a responsible disclosure program without bounties.
Rules of Engagement
Requirements:
- @intigriti.me Required
- User agent: Not applicable
- Automated tooling: max. 5 requests/sec
- Request header: Not applicable
https://go.intigriti.com/researcher-rules-of-engagement
Our Promise to You
- We aim to respond to reports within ultimately two weeks, probably faster!
- We are happy to respond to any questions, please use the button in the right top corner for this.
- We respect the safe harbour clause provided below.
Your Promise to Us
- Provide detailed but to-the-point reproduction steps
- Include a clear attack scenario. How will this affect us exactly?
- Reports should be written in English
- Remember: quality over quantity!
- Please do not discuss or post vulnerabilities without our consent (including PoC's on YouTube and Vimeo)
- Please do not use automatic scanners—be creative and do it yourself! We cannot accept any submissions found by using automatic scanners. Scanners also won't improve your skills, and can cause high server load.
Safe harbour for researchers is applied.
Assets in Scope
In Scope
Found a security issue on our infrastructure that you'd like to report? It doesn't fit the scope of our public program, but at the same time is also not explicitly out of scope?
Please report it responsibly using our VDP.
Any other relevant information concerning Threat Intel is welcome as well, such as:
- Data leaks containing information about water-link employees
- Impersonation or phishing attempts targeting water-link customers
- Information about planned campaigns against water-link
Out of Scope
Same as for our public program:
Application:
- API key disclosure without proven business impact
- Wordpress usernames disclosure
- Pre-Auth Account takeover/OAuth squatting
- Self-XSS that cannot be used to exploit other users
- Verbose messages/files/directory listings without disclosing any sensitive information
- CORS misconfiguration on non-sensitive endpoints
- Missing cookie flags
- Missing security headers
- Cross-site Request Forgery with no or low impact
- Presence of autocomplete attribute on web forms
- Reverse tabnabbing
- Bypassing rate-limits or the non-existence of rate-limits
- Best practices violations (password complexity, expiration, re-use, etc.)
- Clickjacking without proven impact/unrealistic user interaction
- CSV Injection
- Sessions not being invalidated (logout, enabling 2FA, etc.)
- Tokens leaked to third parties
- Anything related to email spoofing, SPF, DMARC or DKIM
- Content injection without being able to modify the HTML
- Username/email enumeration
- Email bombing
- HTTP Request smuggling without any proven impact
- Homograph attacks
- XMLRPC enabled
- Banner grabbing/Version disclosure
- Not stripping metadata of files
- Same-site scripting
- Subdomain takeover without taking over the subdomain
- Arbitrary file upload without proof of the existence of the uploaded file
- Blind SSRF without proven business impact (pingbacks are not sufficient)
- Disclosed/misconfigured Google Maps API keys
- Host header injection without proven business impact
Severity Assessment
This program follows Intigriti's triage standards based on the proof of concept.
FAQ
You can self register on the site, please use your intigriti.me account.
Response Times
- Average time to first response: < 2 weeks
- Average time to triage: < 2 weeks