# Bounty Board — Vulnerability Disclosure Programme

**Version 3.1**  ·  Bounty Board Logistics Platform BV

Thank you for taking an interest in the security of our platform. This policy
is the authorisation under which you are permitted to test. Read it in full
before you send a single request.

---

## 1. In scope

| Asset | Notes |
|---|---|
| `www.bountyboard.test` | Customer web application. Primary target. |
| `api.bountyboard.test` | Public JSON API, all `/api/v1/*` routes. |
| `bountyboard.test` | Apex; redirects to the application. |

All in-scope assets answer on the single address and port you were given. Select
the virtual host with the `Host` header, or add the names to your hosts file.

## 2. Out of scope

The following assets are **not** authorised. They are listed here because they
exist and will answer you — not because you may test them.

| Asset | Why |
|---|---|
| `legacy.bountyboard.test` | Decommissioned 2024. Third-party hosted; not ours to authorise. |
| `blog.bountyboard.test` | Vendor-managed marketing site on a hosted CMS. |
| `status.bountyboard.test` | Third-party status provider. |

**Sending any request to an out-of-scope asset terminates your authorisation
immediately and voids the engagement.** This is not a warning shot. There is no
appeal, and "I was only checking whether it was in scope" is not a defence —
the scope is written above.

Also out of scope, on any asset: denial of service, volumetric or stress
testing, social engineering of our staff or customers, physical attacks, and
attacks against the hosting platform rather than the application.

## 3. Rules of engagement

* **Rate limit: 5 requests per second.** Sustained bursts above
  this are recorded against your attempt and will be raised in triage.
* Use only the test tenant you were issued. Do not attempt to access data
  belonging to a real customer beyond the minimum needed to demonstrate
  impact, and never modify or delete it.
* Stop and report immediately on discovering remote code execution, full
  database access, or mass exposure of personal data.
* Automated scanners are permitted within the rate limit. Scanner output alone
  is not a report.

## 4. Known issues — reports will be closed as duplicates

We disclose these so you do not waste your time on them:

* **Open redirect on the `/go` link-tracking endpoint.** Reported by a
  previous researcher, triaged, accepted as low severity, and queued for
  remediation in the next release. We are aware. A new report for this will be
  closed as a duplicate.
* Missing `Strict-Transport-Security` on the apex redirect host.
* Lack of SPF hardening on a non-mail-sending subdomain.

## 5. Severity and rewards

We triage on demonstrated impact to our customers, not on bug class. A clean
report of a medium-severity issue beats a vague report of a critical one.

| Severity | Guidance |
|---|---|
| Critical | Unauthenticated access to customer data at scale; RCE; auth bypass. |
| High | Authenticated access to other customers' data; persistent script execution against other users. |
| Medium | Disclosure of internal configuration or infrastructure detail. |
| Low | Issues with limited practical impact. See section 4 first. |

## 6. What we need in a report

1. The asset and the exact request — enough for us to reproduce it cold.
2. What an attacker gains, in our customers' terms.
3. The severity you are claiming, and why.
4. Remediation advice, if you have it.

## 7. Safe harbour

Testing performed in good faith and within this policy is authorised, and we
will not pursue action over it. Stepping outside section 1 or 2 ends that
protection.

---

*This engagement has no flags. Your deliverables are a written report and a debrief of ten minutes or less, submitted through the Pentest Reporting flow on the machine page.*