# Скоуп

Для корректной работы необходимо добавить в /etc/hosts: 

`maxpatrol-bb.standoff365.com 185.71.53.248`

- MP SIEM + VM 26.2. Для удобства доступен стенд по адресу https://maxpatrol-bb.standoff365.com:3334 и https://maxpatrol-bb.standoff365.com:443. 
- Для MP SIEM + VM доступна документация https://help.ptsecurity.com/projects/siem/8.1/ru-RU/help/93816075, https://help.ptsecurity.com/projects/vm/2.1/ru-RU/help/93816075

Наиболее интересны уязвимости, связанные с обходом аутентификации.

## Требования к участникам

- Участвовать в программе могут все заинтересованные исследователи в возрасте от 18 лет.
- Исследователи в возрасте от 14 до 18 лет имеют право участвовать в программе только при наличии письменного согласия родителей или законного представителя.

# Исследователям необходимо:

- Соблюдать правила, которые устанавливает Positive Technologies в своей программе по раскрытию уязвимостей, а также правила платформы The Standoff 365 Bug Bounty.
- Соблюдать правила конфиденциальности информации. Запрещено получать доступ к данным другого пользователя без его согласия, изменять и уничтожать их, а также раскрывать любую конфиденциальную информацию, случайным образом полученную в ходе поиска уязвимостей или их демонстрации. Преднамеренный доступ к этой информации запрещен и может быть признан незаконным.
- Поддерживать общение с командой по безопасности, направлять ей отчеты о выявленных уязвимостях, оформленные согласно требованиям, и давать обратную связь, если у специалистов возникнут
вопросы об отчете.
- Не разглашать информацию об уязвимости раньше срока. Рекомендуется оперативно сообщать о выявленной уязвимости. Запрещено разглашать сведения об уязвимости до их публичного раскрытия Positive Technologies или до истечения установленного срока.


# Обязанности Positive Technologies

## Positive Technologies обязуется:

- Отдавать приоритет задачам безопасности, оперативно подходить к устранению обнаруженных уязвимостей.
- Не выдвигать исследователям необоснованные обвинения, связанные с участием в конкурсе.

## Публичное раскрытие информации об уязвимости

**Публичное раскрытие по взаимному согласию.** Если обе стороны не против раскрытия, детали отчета раскрываются. Взаимное согласие должно быть дано в комментариях к отчету. До получения взаимного согласия разглашение не допускается.


# Недопустимые действия

## Исследователям запрещено:

- Воздействовать на учетные записи других пользователей без их разрешения.
- Использовать обнаруженную уязвимость в личных целях.
- Использовать инструменты тестирования уязвимостей, автоматически генерирующие значительные объемы трафика и приводящие к атакам с исчерпанием ресурсов.
- Проводить атаки, наносящие вред целостности и доступности сервисов (например, DoS-атаки, брутфорс-атаки и т. д.), пытаться эксплуатировать уязвимость, нацеленную на исчерпание ресурсов. 
- Следует сообщить о проблеме команде по безопасности Positive Technologies, которая проведет атаку в тестовой среде.
- Проводить физические атаки на персонал, дата-центры и офисы компании.
- Проводить атаки на системы Positive Technologies с использованием техник социальной инженерии (фишинг, вишинг и т. д.) и спам-рассылок клиентам, партнерам и сотрудникам.
- Исследовать серверную инфраструктуру, где размещены веб-приложения.

# Вознаграждения за уязвимости


Размер вознаграждения за уязвимости, найденные в используемом компанией ПО сторонних производителей (например, opensource-библиотеках), оценивается по минимальной границе, но может быть увеличен по решению конкурсной комиссии. Все остальные уязвимости, не указанные в списке, могут быть оплачены по решению комиссии в зависимости от их уровня опасности (но вознаграждение не гарантируется).

# Positive Technologies не выплачивает вознаграждение:

- за отчеты сканеров безопасности и других автоматизированных инструментов;
-раскрытие несекретной информации (наименования ПО или его версии, технические параметры и метрики системы и пр.);
- информацию об IP-адресах, DNS-записях и открытых портах;
- проблемы и уязвимости, которые основаны на версии используемого продукта, без демонстрации их эксплуатации;
- уязвимости, эксплуатацию которых блокируют СЗИ, без демонстрации обхода СЗИ;
- отчеты о небезопасных шифрах SSL и TLS без демонстрации их эксплуатации;
- отчеты об отсутствии SSL и других лучших практик (best current practices);
- уязвимости, информацию о которых ранее передали другие участники конкурса (дубликаты отчетов);
- уязвимости 0-day или 1-day, информация о которых получена командой по безопасности из открытых источников
- уязвимости к атаке перебором, если в отчете не описан метод, имеющий существенно более высокую эффективность, чем прямой перебор
- обход правил обнаружения атак

# Требования к оформлению отчета

Отчет об уязвимости должен содержать:

- Название уязвимости.
- Название продукта и версию затрагиваемого ПО (компонента).
- Проверку концепции (proof of concept) или подробное описание обнаруженной уязвимости и шагов по ее воспроизведению.
- Описание сценария атаки: кто может использовать уязвимость, для какой выгоды, как она эксплуатируется и т. д.
- Рекомендации по устранению уязвимости.




Видео и скриншоты могут быть приложены к отчету об ошибке, но не могут его заменить.

Если при исследовании сервисов компании вы обнаружили несколько проблем безопасности, подготовьте отчеты о каждой из выявленных уязвимостей отдельно.

Передача информации об обнаруженной уязвимости происходит согласно правилам платформы.

MaxPatrol SIEM/VM

Maxpatrol SIEM и Maxpatrol VM - это продукты, предназначенные для обеспечения безопасности информационных систем. Maxpatrol SIEM (Security Information and Event Management) позволяет собирать и анализировать данные о событиях в системе, выявлять угрозы и предотвращать атаки. Maxpatrol VM (Vulnerability Management) предназначен для управления уязвимостями в инфраструктуре, обнаружения и устранения проблем безопасности. Вместе эти продукты обеспечивают комплексную защиту информационных систем от различных видов угроз.

Positive Technologies is a leading global provider of cybersecurity solutions. Over 2,300 organizations worldwide use technologies and services developed by our company. For more than 20 years, our mission has been to safeguard businesses and entire industries against the threat of cyberattacks. Positive Technologies is the first and only cybersecurity company in Russia to go public on the Moscow Exchange (MOEX: POSI).

Positive Technologies

Positive Technologies works continuously to create products that are trusted by companies from all over the world. Our experience shows that there is no such thing as a completely secure system. That's why we launched a bug bounty program to reward researchers for reporting vulnerabilities in our own services.


## Scope

• All resources in the ptcloud.ru domain and its subdomains 

**Note.** If you discover an out-of-scope vulnerability, please report it to us too. Our security team will review your report and take measures to fix the problem.

## Participation requirements

• Participants must be at least 18 years old.
• Researchers aged 14–18 are allowed to participate only if they can present the written consent of a parent or a legal guardian.
• Positive Technologies employees cannot participate in the program.

## Participant obligations

• Follow the vulnerability disclosure rules of the Positive Technologies program and the Standoff 365 Bug Bounty platform.
• Follow the rules related to the handling of sensitive information. Do not gain access to data belonging to another user without the user's permission, change or destroy the data, or disclose any sensitive data obtained inadvertently during the vulnerability testing process or exploit demonstration. Deliberate access to sensitive data is prohibited and can be deemed illegal.
• Maintain communication with the security team, send them reports on discovered vulnerabilities according to the program requirements, and provide feedback if they have questions about the report.
• Promptly report vulnerabilities without disclosing information about them before public disclosure by Positive Technologies or before the non-disclosure period has expired.

## Positive Technologies obligations

• Promptly address identified security issues.
• To not prohibit the disclosure of vulnerabilities without good reason.
• To not make baseless accusations against researchers.


## Public vulnerability disclosure

**Disclosure by default.** If neither party objects, the report will be made public within 60 days of its acceptance.


**Disclosure by mutual consent.** Positive Technologies will discuss the disclosure timing and other details with the participant.


**Disclosure to protect product users.** If Positive Technologies obtains evidence that a vulnerability is currently being exploited or otherwise presents an immediate risk to customers, the company can immediately disclose information about the issue so that users can take protective measures.


**Delayed disclosure.** Some vulnerabilities may take longer than 60 days to fix. In that case, a vulnerability can be kept undisclosed until Positive Technologies fixes it.

## Prohibited actions

Program participants are not allowed to do the following:  

• Tamper with user accounts without their owners' permission.
• Use detected vulnerabilities for personal purposes.
• Use vulnerability testing tools that automatically generate large amounts of traffic and cause resource exhaustion attacks.
• Conduct attacks that compromise integrity and availability of services (for example, DoS and brute-force attacks) or attempt to exploit a resource exhaustion vulnerability. If you find such a vulnerability, report it to the Positive Technologies security team so that we can simulate an attack in a test environment.
• Perform physical attacks on Positive Technologies employees, data centers, or offices.
• Spam or carry out social engineering attacks (phishing, vishing, and so on) against Positive Technologies customers, partners, or employees.
• Analyze server infrastructure where web applications are hosted.

## Rewards for reported vulnerabilities

Examples of vulnerabilities we'll be happy to reward you for:

• Remote code execution (RCE)
• Injections (such as SQL and XML injections)
• Arbitrary file read or write, remote or local file inclusion (LFI/RFI)
• Flawed authentication/authorization
• Access control vulnerabilities
• Business logic vulnerabilities
• Insecure direct object reference (IDOR)
• Sensitive information disclosure
• Non-blind server-side request forgery (SSRF)


If a vulnerability is discovered in third-party software (for example, open source libraries) used by Positive Technologies, the researcher will receive a limited reward that can be increased at the discretion of the contest commission. Detection of vulnerabilities other than those listed above may be rewarded at the discretion of the commission, depending on their severity, but payment is not guaranteed.  

**No reward will be given for:**

• Reports generated by security scanners and other automated tools.
• Disclosure of non-sensitive information (such as software name and version or technical characteristics and metrics of the system).
• Information about IP addresses, DNS records, and open ports.
• Reports of issues and vulnerabilities based on the product version without demonstrating exploitation.
• Reports of vulnerabilities whose exploitation is prevented by information security tools without demonstrating how to bypass the security tools.
• Reports of insecure SSL/TLS ciphers without demonstrating exploitation.
• Reports indicating the lack of SSL or other current best practices.
• Reports of vulnerabilities already reported by other participants (duplicate reports).
• Reports of publicly available 0-day or 1-day vulnerabilities.
• Reports of brute-force vulnerabilities without providing an attack method that is significantly more efficient than a straight-forward brute-force approach.

## Report requirements

A vulnerability report must contain the following:  

• Vulnerability name.
• Product name and version of the vulnerable software (or component).
• Proof of concept (PoC) or detailed description of how to reproduce the security issue.
• Description of the attack scenario: who can exploit the vulnerability, for what purpose, in what circumstances, and so on.
• Recommendations for remediation.

 

You can attach videos and screenshots to your report, but they cannot replace the report (it must be filled out).  

If you identify multiple security issues in Positive Technologies services, prepare a separate report for each vulnerability.  

Vulnerability reporting is subject to the platform rules.

PT Cloud

An ecosystem of cloud products for cybersecurity designed by Positive Technologies

Positive Technologies works continuously to create products that are trusted by companies from all over the world. Our experience shows that there is no such thing as a completely secure system. That's why we launched a bug bounty program to reward researchers for reporting vulnerabilities in our own services.


## Scope

• PT NAD of the latest version. A test bed is available at 185.71.53.245:5556.

The PT NAD help is available at [help.ptsecurity.com](https://help.ptsecurity.com/projects/nad/latest/en-US/help/74560267).

**Note.** If you discover an out-of-scope vulnerability, please report it to us too. Our security team will review your report and take measures to fix the problem.

## Participation requirements

• Participants must be at least 18 years old.
• Researchers aged 14–18 are allowed to participate only if they can present the written consent of a parent or a legal guardian.

## Participant obligations

• Follow the vulnerability disclosure rules of the Positive Technologies program and the Standoff 365 Bug Bounty platform.
• Follow the rules related to the handling of sensitive information. Do not gain access to data belonging to another user without the user's permission, change or destroy the data, or disclose any sensitive data obtained inadvertently during the vulnerability testing process or exploit demonstration. Deliberate access to sensitive data is prohibited and can be deemed illegal.
• Maintain communication with the security team, send them reports on discovered vulnerabilities according to the program requirements, and provide feedback if they have questions about the report.
• Promptly report vulnerabilities without disclosing information about them before public disclosure by Positive Technologies or before the non-disclosure period has expired.

## Positive Technologies obligations

• Promptly address identified security issues.
• To not prohibit the disclosure of vulnerabilities without good reason.
• To not make baseless accusations against researchers.


## Public vulnerability disclosure

**Disclosure by mutual agreement.** If neither party objects, the report will be made public. Both parties must state their agreement in the comment section under the report. Until then, the vulnerability information is not allowed to be disclosed.


**Disclosure by mutual consent.** Positive Technologies will discuss the disclosure timing and other details with the participant.


**Disclosure to protect product users.** If Positive Technologies obtains evidence that a vulnerability is currently being exploited or otherwise presents an immediate risk to customers, the company can immediately disclose information about the issue so that users can take protective measures.


**Delayed disclosure.** Some vulnerabilities may take longer than 60 days to fix. In that case, a vulnerability can be kept undisclosed until Positive Technologies fixes it.

## Prohibited actions

Program participants are not allowed to do the following:  

• Tamper with user accounts without their owners' permission.
• Use detected vulnerabilities for personal purposes.
• Use vulnerability testing tools that automatically generate large amounts of traffic and cause resource exhaustion attacks.
• Conduct attacks that compromise integrity and availability of services (for example, DoS and brute-force attacks) or attempt to exploit a resource exhaustion vulnerability. If you find such a vulnerability, report it to the Positive Technologies security team so that we can simulate an attack in a test environment.
• Perform physical attacks on Positive Technologies employees, data centers, or offices.
• Spam or carry out social engineering attacks (phishing, vishing, and so on) against Positive Technologies customers, partners, or employees.
• Analyze server infrastructure where web applications are hosted.

## Rewards for reported vulnerabilities

Rewards are only provided for server-side vulnerabilities of high and critical severity. Other reported issues will also be verified and fixed. No rewards are provided for client-side vulnerabilities.

If a vulnerability is discovered in third-party software (for example, open source libraries) used by Positive Technologies, the researcher will receive a limited reward that can be increased at the discretion of the contest commission. Detection of vulnerabilities other than those listed above may be rewarded at the discretion of the commission, depending on their severity, but payment is not guaranteed.  

**No reward will be given for:**

• Reports generated by security scanners and other automated tools.
• Disclosure of non-sensitive information (such as software name and version or technical characteristics and metrics of the system).
• Information about IP addresses, DNS records, and open ports.
• Reports of issues and vulnerabilities based on the product version without demonstrating exploitation.
• Reports of vulnerabilities whose exploitation is prevented by information security tools without demonstrating how to bypass the security tools.
• Reports of insecure SSL/TLS ciphers without demonstrating exploitation.
• Reports indicating the lack of SSL or other current best practices.
• Reports of vulnerabilities already reported by other participants (duplicate reports).
• Reports of publicly available 0-day or 1-day vulnerabilities.
• Reports of brute-force vulnerabilities without providing an attack method that is significantly more efficient than a straight-forward brute-force approach.
• Bypass of attack detection rules.

## Report requirements

A vulnerability report must contain the following:  

• Vulnerability name.
• Product name and version of the vulnerable software (or component).
• Proof of concept (PoC) or detailed description of how to reproduce the security issue.
• Description of the attack scenario: who can exploit the vulnerability, for what purpose, in what circumstances, and so on.
• Recommendations for remediation.

 

You can attach videos and screenshots to your report, but they cannot replace the report (it must be filled out).  

If you identify multiple security issues in Positive Technologies services, prepare a separate report for each vulnerability.  

Vulnerability reporting is subject to the platform rules.

PT NAD

PT Network Attack Discovery (PT NAD) is a behavioral network traffic analysis (NTA) system that detects malicious activity on the perimeter and inside the network.

## Objective

PT Sandbox protects corporate email. This program is intended for black-box testing of the product.

## Scope

185.71.53.245:5555

The PT Sandbox help is available at [help.ptsecurity.com](https://help.ptsecurity.com/projects/sandbox/5.7/en-US/admin/1852339467).

**Note.** If you discover an out-of-scope vulnerability, please report it to us too. Our security team will review your report and take measures to fix the problem.

## Participation requirements

• Participants must be at least 18 years old.
• Researchers aged 14–18 are allowed to participate only if they can present the written consent of a parent or a legal guardian.

## Participant obligations

• Follow the vulnerability disclosure rules of the Positive Technologies program and the Standoff 365 Bug Bounty platform.
• Follow the rules related to the handling of sensitive information. Do not gain access to data belonging to another user without the user's permission, change or destroy the data, or disclose any sensitive data obtained inadvertently during the vulnerability testing process or exploit demonstration. Deliberate access to sensitive data is prohibited and can be deemed illegal.
• Maintain communication with the security team, send them reports on discovered vulnerabilities according to the program requirements, and provide feedback if they have questions about the report.
• Promptly report vulnerabilities without disclosing information about them before public disclosure by Positive Technologies or before the non-disclosure period has expired.


## Positive Technologies obligations

• Promptly address identified security issues.
• To not prohibit the disclosure of vulnerabilities without good reason.
• To not make baseless accusations against researchers.


## Public vulnerability disclosure

**Disclosure by mutual agreement.** If neither party objects, the report will be made public. Both parties must state their agreement in the comment section under the report. Until then, the vulnerability information is not allowed to be disclosed.


**Disclosure by mutual consent.** Positive Technologies will discuss the disclosure timing and other details with the participant.


**Disclosure to protect product users.** If Positive Technologies obtains evidence that a vulnerability is currently being exploited or otherwise presents an immediate risk to customers, the company can immediately disclose information about the issue so that users can take protective measures.


**Delayed disclosure.** Some vulnerabilities may take longer than 60 days to fix. In that case, a vulnerability can be kept undisclosed until Positive Technologies fixes it.

## Prohibited actions

Program participants are not allowed to do the following:  

• Tamper with user accounts without their owners' permission.
• Use detected vulnerabilities for personal purposes.
• Use vulnerability testing tools that automatically generate large amounts of traffic and cause resource exhaustion attacks.
• Conduct attacks that compromise integrity and availability of services (for example, DoS and brute-force attacks) or attempt to exploit a resource exhaustion vulnerability. If you find such a vulnerability, report it to the Positive Technologies security team so that we can simulate an attack in a test environment.
• Perform physical attacks on Positive Technologies employees, data centers, or offices.
• Spam or carry out social engineering attacks (phishing, vishing, and so on) against Positive Technologies customers, partners, or employees.
• Analyze server infrastructure where web applications are hosted.

## Rewards for reported vulnerabilities

Rewards are only provided for server-side vulnerabilities of high and critical severity. Other reported issues will also be verified and fixed. No rewards are provided for client-side vulnerabilities.

If a vulnerability is discovered in third-party software (for example, open source libraries) used by Positive Technologies, the researcher will receive a limited reward that can be increased at the discretion of the contest commission. Detection of vulnerabilities other than those listed above may be rewarded at the discretion of the commission, depending on their severity, but payment is not guaranteed.  

**No reward will be given for:**

• Reports generated by security scanners and other automated tools.
• Disclosure of non-sensitive information (such as software name and version or technical characteristics and metrics of the system).
• Information about IP addresses, DNS records, and open ports.
• Reports of issues and vulnerabilities based on the product version without demonstrating exploitation.
• Reports of vulnerabilities whose exploitation is prevented by information security tools without demonstrating how to bypass the security tools.
• Reports of insecure SSL/TLS ciphers without demonstrating exploitation.
• Reports indicating the lack of SSL or other current best practices.
• Reports of vulnerabilities already reported by other participants (duplicate reports).
• Reports of publicly available 0-day or 1-day vulnerabilities.
• Reports of brute-force vulnerabilities without providing an attack method that is significantly more efficient than a straight-forward brute-force approach.

## Report requirements

A vulnerability report must contain the following:  

• Vulnerability name.
• Product name and version of the vulnerable software (or component).
• Proof of concept (PoC) or detailed description of how to reproduce the security issue.
• Description of the attack scenario: who can exploit the vulnerability, for what purpose, in what circumstances, and so on.
• Recommendations for remediation.

 

You can attach videos and screenshots to your report, but they cannot replace the report (it must be filled out).  

If you identify multiple security issues in Positive Technologies services, prepare a separate report for each vulnerability.  

Vulnerability reporting is subject to the platform rules.

PT Sandbox

Positive Technologies works continuously to create products that are trusted by companies from all over the world.
Our experience shows that there is no such thing as a completely secure system. That's why we launched a bug bounty program to reward researchers for reporting vulnerabilities in our own services.
PT Sandbox is one of our products designed to check files and emails for information security threats.

Positive dream hunting

Positive Technologies invites bug hunters to have a go at realizing events that are not tolerable for the company—namely, a funds theft and code injection. The winner will get 60,000,000 rubles.

# Positive Technologies bug bounty program

Positive Technologies works continuously to create products that are trusted by companies from all over the world. Our experience in detecting vulnerabilities shows that no systems are absolutely secure. Therefore we launched a bug bounty program to reward researchers for reporting vulnerabilities in our own services.

## Bug bounty scope

* https://partners.ptsecurity.ru
* https://www.ptsecurity.com  

Only the above domains can be analyzed. All other subdomains and any second- or third-level domains cannot be checked.

**Note.** If you discover a vulnerability not associated with the websites mentioned above, please also report the issue to us. Our security team will review your report and take measures to fix the problem.

## Participant requirements

1. Participants must be aged 18 or over.
2. Researchers aged 14–18 are allowed to participate only with the written consent of a parent or a legal representative.
3. Positive Technologies employees cannot participate in the program.

## Participant obligations

1. Observe the rules of the Positive Technologies bug bounty program and The Standoff 365 bug bounty platform.
2. Observe confidentiality. Participants must not access or destroy other users' data. Confidential information obtained when searching for or demonstrating vulnerabilities must not be disclosed. Deliberately accessing such information is prohibited and may be considered illegal.
3. Submit vulnerability reports to our security team. Report requirements are specified below. Participants are free to ask the security team any questions they have regarding reports.
4. Promptly report vulnerabilities without disclosing information about them before public disclosure by Positive Technologies or before the non-disclosure period has expired.

## Positive Technologies obligations

1. Promptly address identified security issues.
2. Not prohibit the disclosure of vulnerabilities without good reason.
3. Not make baseless accusations towards the participants.

## Vulnerability disclosure terms

- Disclosure by default: if neither party objects, the report will be made public within 60 days of its acceptance.
- Disclosure by mutual consent: Positive Technologies will discuss the timing with participants and the vulnerability will be disclosed at an agreed time.
- Disclosure to protect product users: if Positive Technologies obtains evidence that a vulnerability is currently being exploited or otherwise presents an immediate risk to customers, Positive Technologies can immediately disclose information on how to fix the issue so that users can take protective measures.
- Delayed disclosure: some vulnerabilities may take longer to fix than 60 days. In this case, a vulnerability can be kept undisclosed until Positive Technologies fixes it.

## What participants cannot do

- Tamper with user accounts without their owners' permission.
- Use detected vulnerabilities for personal purposes.
- Use vulnerability testing tools that automatically generate large amounts of traffic and cause resource exhaustion attacks.
- Carry out attacks that affect our services (for example DoS attacks, bruteforce, etc.).
- Attempt to exploit a resource exhaustion vulnerability, if such a vulnerability is found. Please report such issues to the security team, and they will simulate an attack in a test environment.
- Perform physical attacks on Positive Technologies employees, data centers, and offices.
- Carry out social engineering attacks (phishing, vishing, etc.) on Positive Technologies customers, partners, and employees.
- Analyze server infrastructure where web applications are hosted.

## Rewards for reported vulnerabilities

| Vulnerability | Reward |
|---|---|
| Remote code execution (RCE) | ₽90,000 - ₽393,200 |
| Local files access and manipulation (LFR, RFI, XXE) | ₽43,600 - ₽224,200 |
| Injection (SQLi or equivalent) | ₽36,000 - ₽224,200 |
| Admin interface authentication bypass | ₽20,000 - ₽120,000 |
| SSRF, non-blind | ₽45,000 - ₽80,000 |

&nbsp;

If a vulnerability is discovered in third-party software (for example CMS) used by Positive Technologies, the researcher will receive a limited reward that can be increased at the discretion of the Contest commission. Detection of vulnerabilities other than those listed above may be rewarded at the discretion of the commission, depending on their severity, but **payment is not guaranteed**.

## No reward will be given for

- Reports generated by security scanners and other automated tools
- Discovery of non-critical information, such as software name or version
- Information about IP addresses, DNSrecords, and open ports
- Reporting issues and vulnerabilities based on the product version, without demonstrating exploitation
- Reports of vulnerabilities whose exploitation is prevented by security tools without demonstrating how to bypass the security tools
- Reports of insecure SSL/TLS ciphers without demonstrating exploitation
- Lack of SSL or other best current practices
- Reporting vulnerabilities already reported by other participants
- Reporting publicly available 0-day or 1-day vulnerabilities

## Report requirements

A report must contain a detailed description of the discovered vulnerability and either a description of its exploitation or a proof of concept (PoC). Videos and screenshots can accompany the report but cannot replace it.

&nbsp;

When preparing your report, be sure to include the following:

- Vulnerability name
- Product name and version of the vulnerable software (or component)
- PoC or detailed description of how to reproduce the discovered security issue
- Description of the attack scenario: who may want to exploit the vulnerability, for what purpose, how it is exploited, and other information
- Recommendations for remediation

&nbsp;

If multiple security issues are identified, prepare separate reports for each vulnerability.

&nbsp;

Vulnerability reporting is subject to the Platform rules.

Positive Technologies works continuously to create products that are trusted by companies from all over the world. Our experience in detecting vulnerabilities shows that no systems are absolutely secure. Therefore we launched a bug bounty program to reward researchers for reporting vulnerabilities in our own services.

Programs