Contacts+ Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

If you are a Security Researcher, please let us know about any security issue and we’ll make every effort to quickly correct it. However you must follow our responsible disclosure policy:

- Disclose the vulnerability and all known details promptly.

- Give us a reasonable time to respond to the issue before making any information about it public in order to protect our users from a possible malicious attack in response to your disclosure. You’re more than welcome to post a write-up after the issue has been fixed and public disclosure has been agreed upon.

- Limit the scope of your activities to Contacts+ properties not those belonging to other services we may use such as analytics providers or support helpdesk. Those issues should be reported to the providers directly. If you’re unsure how to proceed please contact us!

- Clickjacking or other forms of deceit are not in scope for our marketing website (www.contactsplus.com) but are in scope for our web app (app.contactsplus.com).

Testing Requirements:

Please do not run any sort of load testing (e.g. DDoS attacks tests) on any of our assets

Act in good faith not to degrade the performance of our services (including denial of service). We understand accidents may happen.
Strive not to access or modify information in users’ accounts should you find a vulnerability. If necessary, please create a second account to demonstrate the issue. If you cannot, you may report using real accounts.

Possible Awards:

Bounties are assigned entirely at the discretion of the Contacts+’s security team.

Valid reports are classified be severity - low, medium and high.
Low severity items are not eligible for a reward.

Medium and High severity items will be rewarded at the discretion of the Contacts+ security team only, on a per case basis.

Special Notes:

We do not wish to receive reports about the following topics:
1. Possible DoS vulnerabilities
2. Email protections (SPF, DKIM, DMARC)
3. Attackers creating accounts using victim's email address, unless you can show POC for data-leak or account-takeover
4. Clickjacking (and other forms of deceit) are not in scope for our marketing website - www.contactsplus.com, but are in scope for our web app - app.contactsplus.com
5. Ability to view our backend's load-balancer IP address, unless you can demonstrate a valid attack vector using it (e.g. via SSRF)
6. Visibility into specific tools versions we may be using (e.g. nginx version), unless you can demonstrate an attack vector.

False reports:
1. Password change policy - we WILL ask for re-authentication before changing the password if a certain number of minutes passed since last authentication
2. Wrong password attempts limitation - please test with valid passwords only, invalid password (e.g. short passwords) do not count against the quota
3. CORS attack using a Contacts+ controlled subdomain (e.g. anything.contactsplus.com)
4. Geolocation/EXIF not stripped from uploaded images
5. Re-authenticate before deleting account - we WILL ask for re-authentication before deleting an account if a certain number of minutes passed since last authentication
6. Session invalidate on password change - Contacts+ will invalidate other sessions, but there might be a few minutes of delay
7. Blog related issues (e.g. seeing blog post authors list)
8. Using Email+password and then using SSO to login to the same account for account takeover - when SSO is used on an existing account for the first time the system will reset the password preventing this scenario
9. Firebase api key can be viewed publicly in our code (please read this: https://firebase.google.com/docs/projects/api-keys)
10. A non-admin can export all contacts from a shared address-book (intentional)
11. Rate-limits / DoS protection / memory attack - our APIs rate limits are very high to support certain user flows on purpose, for most of our APIs reaching the rate limit and getting blocked will not work for a single machine running Burp, but will protect against a botnet army.
12. SSL/TLS versions, unless you can demonstrate an attack.

*** Entering contacts+ website to some public security analyzer site and sending us the report does not count as investing time and will not be considered for a bounty ***