Positive Technologies bug bounty program

Bug bounty scope

• *.ptsecurity.com;
• *.ptsecurity.ru;
• *.maxpatrol.com;
• *.maxpatrol.ru;
• *.phdays.com;
• *.phdays.ru

Participant requirements

1. Participants must be aged 18 or over.
2. Researchers aged 14–18 are allowed to participate only with the written consent of a parent or a legal representative.
3. Current Positive Technologies employees and former employees who left less than three years ago may participate in the program but are not eligible for rewards.

Participant obligations

1. Observe the rules of the Positive Technologies bug bounty program and The Standoff 365 bug bounty platform.
2. Observe confidentiality. Participants must not access or destroy other users' data. Confidential information obtained when searching for or demonstrating vulnerabilities must not be disclosed. Deliberately accessing such information is prohibited and may be considered illegal.
3. Submit vulnerability reports to our security team. Report requirements are specified below. Participants are free to ask the security team any questions they have regarding reports.
4. Promptly report vulnerabilities without disclosing information about them before public disclosure by Positive Technologies or before the non-disclosure period has expired.

Positive Technologies obligations

1. Prioritize security tasks and promptly address any discovered vulnerabilities.
2. Respect researchers and refrain from obstructing the disclosure of report information without valid grounds.
3. Refrain from making unfounded accusations against researchers regarding their participation in the competition.
4. Credit the researcher who discovered the vulnerability when publishing information about it.

Prohibited Actions

• Interacting with other users' accounts without their permission.
• Using a discovered vulnerability for personal gain.
• Using vulnerability testing tools that automatically generate significant traffic volumes and lead to resource exhaustion attacks.
• Conducting attacks that compromise the integrity or availability of services (e.g., DoS attacks, brute-force attacks, etc.) or attempting to exploit vulnerabilities aimed at resource exhaustion. Instead, report the issue to the Positive Technologies security team, who will conduct the attack in a test environment.
• Conducting physical attacks against company personnel, data centers, or offices.
• Attacking Positive Technologies systems using social engineering techniques (phishing, vishing, etc.) or sending spam to clients, partners, or employees.
• Investigating the server infrastructure hosting the web applications.

Rewards for reported vulnerabilities

No reward will be given for

• Reports generated by security scanners and other automated tools
• Discovery of non-critical information, such as software name or version
• Information about IP addresses, DNSrecords, and open ports
• Reporting issues and vulnerabilities based on the product version, without demonstrating exploitation
• Reports of vulnerabilities whose exploitation is prevented by security tools without demonstrating how to bypass the security tools
• Reports of insecure SSL/TLS ciphers without demonstrating exploitation
• Lack of SSL or other best current practices
• Reporting vulnerabilities already reported by other participants
• Reporting publicly available 0-day or 1-day vulnerabilities

Report requirements

• Vulnerability name
• Product name and version of the vulnerable software (or component)
• PoC or detailed description of how to reproduce the discovered security issue
• Description of the attack scenario: who may want to exploit the vulnerability, for what purpose, how it is exploited, and other information
• Recommendations for remediation