Scope

• All resources in the ptcloud.ru domain and its subdomains

Participation requirements

1. Participants must be at least 18 years old.
2. Researchers aged 14–18 are allowed to participate only if they can present the written consent of a parent or a legal guardian.
3. Current Positive Technologies employees, as well as former employees whose employment ended less than three years ago, may take part in the program but are not eligible to receive a bounty payout.

1. Follow the vulnerability disclosure rules of the Positive Technologies program and the Standoff 365 Bug Bounty platform.
2. Follow the rules related to the handling of sensitive information. Do not gain access to data belonging to another user without the user's permission, change or destroy the data, or disclose any sensitive data obtained inadvertently during the vulnerability testing process or exploit demonstration. Deliberate access to sensitive data is prohibited and can be deemed illegal.
3. Maintain communication with the security team, send them reports on discovered vulnerabilities according to the program requirements, and provide feedback if they have questions about the report.
4. Do not publicly disclose any details of the vulnerabilities discovered. Positive Technologies retains the right to decide if and when information about the reported vulnerability will be published.

Positive Technologies obligations

1. Promptly address identified security issues.
2. To not prohibit the disclosure of vulnerabilities without good reason.
3. To not make baseless accusations against researchers.
4. If details of a vulnerability are published, credit the security researcher who reported it.

Prohibited actions

• Tamper with user accounts without their owners' permission.
• Use detected vulnerabilities for personal purposes.
• Use vulnerability testing tools that automatically generate large amounts of traffic and cause resource exhaustion attacks.
• Conduct attacks that compromise integrity and availability of services (for example, DoS and brute-force attacks) or attempt to exploit a resource exhaustion vulnerability. If you find such a vulnerability, report it to the Positive Technologies security team for simulation of an attack in a test environment.
• Perform physical attacks on the company's employees, data centers, or offices.
• Spam or carry out social engineering attacks (phishing, vishing, and so on) against Positive Technologies customers, partners, or employees.
• Analyze the underlying server infrastructure hosting the web applications.

Rewards for reported vulnerabilities

• Remote code execution (RCE)
• Injections (such as SQL and XML injections)
• Arbitrary file read or write, remote or local file inclusion (LFI/RFI)
• Flawed authentication/authorization
• Access control vulnerabilities
• Business logic vulnerabilities
• IDOR
• Sensitive information disclosure
• Non-blind server-side request forgery (SSRF)

• Reports generated by security scanners and other automated tools.
• Disclosure of non-sensitive information (such as software name and version or technical characteristics and metrics of the system).
• Information about IP addresses, DNS records, and open ports.
• Reports of issues and vulnerabilities based on the product version without demonstrating exploitation.
• Reports of vulnerabilities whose exploitation is prevented by information security tools without demonstrating how to bypass the security tools.
• Reports of insecure SSL/TLS ciphers without demonstrating exploitation.
• Reports indicating the lack of SSL or other current best practices.
• Reports of vulnerabilities already reported by other participants (duplicate reports).
• 0-day or 1-day vulnerabilities identified by our security team based on information from open sources.
• Reports of brute-force vulnerabilities without providing an attack method that is significantly more efficient than a straight-forward brute-force approach.

Report requirements

• Vulnerability name.
• Product name and version of the vulnerable software (or component).
• Proof of concept (PoC) or detailed description of how to reproduce the security issue.
• Description of the attack scenario: who can exploit the vulnerability, for what purpose, in what circumstances, and so on.
• Recommendations for remediation.