Crypto Bug Bounty Program
The security of our operations is our highest priority. Whether you are a professional security researcher or a beginner, we welcome your security reports
The security of our operations is our highest priority. Whether you are a professional security researcher or a beginner, we welcome your security reports
Tell us how the vulnerability you've discovered might be used theoretically and practically
What steps to take on how the vulnerability can be exploited and how we can reproduce the issue ourselves
Use any language you like if you don’t speak English. Our international team will consider your security report in any case
We don't reward you for the already known vulnerabilities, check the list here
"Vulnerabilities" that affect or are present on other major websites will not be rewarded
Our SPF record is valid, and we do not deem account deletion a security vulnerability
Thanks to the researchers who have already reported important security issues! Learn the history of our rewards
A missing DNS CAA record
Ticket Trick vulnerability
The presence of JPEG EXIF metadata
Some IPs of our servers are exposed to the internet
Plain text passwords are sent to our users via email
HTTP headers injections/forgery - we use SSL for all critical servers
Most of the information about our publishers' sites and advertisers' campaigns is public
You can press the back button in your browser after logging off and continue to see your logged in user pages
Software versions being exposed unless this could lead to a working exploit against our infrastructure
HTTP security headers-related issues (unless there is a way to exploit them)
Rate limit for APIs
It is possible to find out if a particular email address is already signed up
There is a way to terminate a browser session of another user
click.a-ads.com domain can potentially be used for spoofing but it's a separate domain created specifically for link redirection
Our blog config.yml is publicly accessible