{"title":"Alasco GmbH - Bug Bounty Program","slug":"alasco-gmbh-bug-bounty-program","rules":"## About Alasco GmbH\n\nAlasco offers state of the art software for financial controlling and ESG management. \nSecurity is very important to us and this Bug Bounty program shall help us meet highest industry standards to offer the most secure service and experience to all parties.\n\n## Program Rules\n\n### Attention: Business Continuity and Testing Conduct\n\nMaintaining uninterrupted service for our users and partners is absolutely critical. All security testing must be performed with extreme care to **avoid any form of business disruption**. This includes actions that could degrade performance, interrupt service availability, or affect real customers.\n\nResearchers are expected to act responsibly at all times and prioritize the stability, integrity, and security of Alasco systems above all else. If in doubt, stop testing immediately and seek clarification through the platform\u2019s report discussion thread before proceeding.\n\n### Testing Policy and Responsible Disclosure\n\nThe below two rule sets form the **core foundation** of the Alasco Vulnerability Reward Program.\n\nThey are designed to protect business continuity, user data, and testing integrity.\n\n- **Priority Zero Rules** are **global and non-negotiable**. They apply to all testing activities across all targets and take precedence over any other instruction or rule.\n- **Target-specific Program Rules** define **additional, per-target constraints** \u2014 such as testing windows, rate limits, allowed endpoints, or isolated environments \u2014 to ensure safe and controlled testing for specific systems.\n\nAll researchers must review and follow both rule sets **before starting any testing**.\n\nViolating either may result in **disqualification of reports, revocation of bounty eligibility, or, in severe cases, suspension or termination of the entire program** if operational damage occurs.\n\n### Priority Zero Rules\n\nPlease adhere to the following rules while performing research on this program:\n\n- Denial of service (DoS) attacks on Alasco GmbH applications, servers, networks, or infrastructure are strictly forbidden.\n- Tests that could cause degradation or interruption of our services are strictly forbidden.\n- Do not use automated scanners or tools that generate large amounts of network traffic, or use them in a very gentle way (maximum **1 request per second** unless explicitly permitted otherwise).\n- Do not leak, manipulate, destroy, download, copy, or exfiltrate any user data, company data, or files from our applications, servers, or systems.\n- Do not alter real data under any circumstances.\n- No vulnerability disclosure, full, partial, or otherwise, is allowed without explicit written consent from Alasco.\n- Do not spam registration forms or any public-facing forms on our websites, including but not limited to https:\/\/www.alasco.de\/explore\/\n- You must append the defined user-agent to all web-based requests.\n- Use dummy\/test accounts and clearly identifiable test data whenever possible.\n- If Alasco\u2019s Security Team requests that you pause or stop testing, you must comply immediately.\n- If you are unsure whether an action is safe, **stop testing and ask first** via the report discussion thread.\n\n### Target-specific Program Rules\n\nIn addition to the Priority Zero Rules above, the following target-specific rules apply where communicated for a given scope:\n\n- **Test only during approved hours** \n Limit all testing activities to **08:00\u201317:00 CET**. Do not perform any scans, automation, or manual testing outside this time window unless you have explicit written approval.\n\n- **Do not disrupt our business** \n Do not run automation, scans, or tests that could degrade performance, disrupt services, or impact real users. If your activity risks service stability, stop immediately.\n\n- **Avoid heavy automation** \n Do not run parallelized or high-volume automated tooling unless you have prior written approval. Default behaviour should be manual or single-threaded, low-rate testing.\n\n- **No public disclosure without explicit written consent** \n Do not share findings, screenshots, logs, or artifacts with third parties. Report exclusively through the designated vulnerability disclosure platform. Public disclosure of any vulnerability requires written consent from Alasco \u2014 no exceptions.\n\n- **No altering of real data** \n Never change, download, or exfiltrate company data \u2014 even if you gain access to any.\n\n- **Use identifiable test data** \n Use dummy\/test accounts and data that can be distinguished from normal traffic and production data.\n\n- **Follow Security Team instructions immediately** \n If Alasco\u2019s Security Team requests that you pause or stop testing, comply at once. Their direction takes precedence to protect users and operations.\n\n- **If in doubt \u2014 stop and ask** \n When unsure about impact, environment, or data, pause testing and ask in the report discussion thread before proceeding.\n\n## Reward Eligibility\n\nWe are happy to thank everyone who submits valid reports which help us improve the security of Alasco GmbH, however only those that meet the following eligibility requirements may receive a monetary reward:\n\n- You must be the first reporter of a vulnerability.\n- The same vulnerability in different scopes will only count as one vulnerability.\n- The vulnerability must be a qualifying vulnerability.\n- The report must contain the following elements:\n - Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users, and Alasco GmbH, and remediation advice on fixing the vulnerability.\n - Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact.\n - Complete steps with the necessary information to reproduce the exploit, including, if necessary, code snippets, payloads, commands, etc.\n- You must not break any of the testing policy rules listed above.\n- You must not be a former or current employee of Alasco GmbH or one of its contractors.\n\n### Reward Grid\n\nReward amounts are based on:\n\n- Reward grid of the report's scope\n- CVSS scoring and actual business impact of the vulnerability upon performing risk analysis\n- Discretionary judgement of Alasco\u2019s CISO","rules_html":"

About Alasco GmbH<\/h2>\n

Alasco offers state of the art software for financial controlling and ESG management.
\nSecurity is very important to us and this Bug Bounty program shall help us meet highest industry standards to offer the most secure service and experience to all parties.<\/p>\n

Program Rules<\/h2>\n

Attention: Business Continuity and Testing Conduct<\/h3>\n

Maintaining uninterrupted service for our users and partners is absolutely critical. All security testing must be performed with extreme care to avoid any form of business disruption<\/strong>. This includes actions that could degrade performance, interrupt service availability, or affect real customers.<\/p>\n

Researchers are expected to act responsibly at all times and prioritize the stability, integrity, and security of Alasco systems above all else. If in doubt, stop testing immediately and seek clarification through the platform\u2019s report discussion thread before proceeding.<\/p>\n

Testing Policy and Responsible Disclosure<\/h3>\n

The below two rule sets form the core foundation<\/strong> of the Alasco Vulnerability Reward Program.<\/p>\n

They are designed to protect business continuity, user data, and testing integrity.<\/p>\n