CloudCannon Bug Bounty
Welcome to CloudCannon's bug bounty programme. If you believe you've found a critical vulnerability please follow the steps below and create a bug report. While we appreciate all submissions, only critical bugs are within scope.
looks_one Check Scope
Confirm the bug fits within the scope defined in the Bug Bounty Policy
looks_two Submit Report
Submit your report which includes clear, concise and reproducible steps to replicate the issue.
The CloudCannon support team will make contact within five working days to acknowledge we have received your report.
looks_4 Assessment & Rewards
CloudCannon will assess the report and will offer a reward based on severity and current scope.
Only the CloudCannon app (app.cloudcannon.com) is within scope. Other subdomains will not be considered for bug bounties. At this stage we will only be assessing critical vulnerabilities.
CloudCannon will award valid reports based on the scope and severety of each report. Monetary rewards are paid by PayPal transactions only. Any charges incurred for PayPal transactions will not be covered by CloudCannon.
|https://app.cloudcannon.com||Critical||Yes||$50 - $100 USD|
|https://app.cloudcannon.com||Moderate||Yes||$20 - $50 USD|
Bug Bounty Policy
Only critical vulnerabilities that demonstrate complete compromise of the system's integrity or confidentiality are eligible for a bounty. While we encourage you to submit all potential issues, lower severity issues are not in scope at this time.
It's important to keep in mind that not all submissions will qualify for a bounty, and that the decision to award a bounty is entirely at the discretion of CloudCannon. CloudCannon have the final decision on which issues constitute security vulnerabilities.
- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
- Making many substantially similar reports will only be eligible for one bounty award, and marked as duplicate. For example, the same vulnerability reported across multiple subdomains. Please consolidate issues into a single report.
- Do not make any information public until the issue has been resolved.
- Do not access or modify data that does not belong to you - create a free account to test with.
While researching, we'd like to ask you to refrain from:
- Denial of service
- Social engineering (including phishing) of CloudCannon staff or contractors
- Any physical attempts against CloudCannon property or data centers
Any activities conducted in a manner consistent with this policy will be considered authorised conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping to keep CloudCannon and our users safe!
Please provide as much information as possible about the potential issue you have discovered. The more information you provide, the faster CloudCannon will be able to validate the issue.