{"title":"ZECIBLE PUBLIC BUG BOUNTY PROGRAM","slug":"zecible-public-bug-bounty-program","rules":"## About\n\n### ZECIBLE\n\nZECIBLE is a company that delivers many services to its customers. Security is very important to us and this Bug Bounty program shall help us meet highest industry standards to offer the most secure service and experience to all parties.\n\n## Program Rules\n\n### Testing Policy, Responsible Disclosure\n\nPlease adhere to the following rules while performing research on this program:\n- **Make sure to apply hunting requirements policy, specifically User-Agent, so that our teams know the detected activity is related to this program. If not, you might be blocked from our assets due to our security protocols.**\n- Denial of service (DoS) attacks on ZECIBLE applications, servers, networks or infrastructure are strictly forbidden.\n- Avoid tests that could cause degradation or interruption of our services.\n- Do not use automated scanners or tools that generate large amount of network traffic\n- Do not leak, copy, manipulate, or destroy any user data or files in any of our applications\/servers.\n- No vulnerability disclosure, full, partial or otherwise, is allowed.\n\n### Reward Eligibility\n\nWe are happy to thank everyone who submits valid reports which help us improve the security of ZECIBLE, however only those that meet the following eligibility requirements may receive a monetary reward:\n- You must be the first reporter of a vulnerability.\n- The vulnerability must be a qualifying vulnerability\n- The report must contain the following elements:\n - Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and ZECIBLE, and remediation advice on fixing the vulnerability\n - Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact\n - Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc\n- You must not break any of the testing policy rules listed above\n- You must not be a former or current employee of ZECIBLE or one of its contractors.\n\nReward amounts are based on:\n- Reward grid of the report's scope\n- CVSS scoring and actual business impact of the vulnerability upon performing risk analysis\n\n### Known behaviours (not eligible)\n\nThe following behaviours are intended. Reports that only describe them will be closed without reward.\n\n**ywh.comptage.zecible.fr - counting tool**\n- The counting tool is public on purpose: without an account, anyone can build a targeting, get counts, breakdowns and prices, and upload a list of criteria (postal codes, cities, company IDs...). This applies to the pages and to the AJAX calls behind them.\n- The login form protects the customer area (orders, extractions, saved targetings), not the counting tool.\n- Counts, breakdowns, prices and reference lists (cities, population, activity codes, legal forms...) are aggregated or public data. Obtaining contact records requires a customer account.\n\n**ywh.fichiers.zecible.fr - file transfer**\n- Sending a file is public on purpose: anyone can upload and send a file without an account.\n- An upload is only eligible if it leads to code execution or gives access to a file sent by someone else.\n\n**All scopes**\n- Anti-CSRF tokens are not an authentication mechanism: a read-only call accepted without one, or a token present in the page it protects, is not a vulnerability by itself.\n- A missing access control is only eligible if it gives access to data or actions that the application reserves for customers, administrators or other users.\n\n## Complements about our scopes\n\n### ZECIBLE Scope \n\nImportant information about our scopes:\n\n- **When testing contact forms or any other interaction with our teams, please use your YesWeHack email aliases which are [available here](https:\/\/yeswehack.com\/user\/my-yeswehack\/email-alias) and include keywords such as \"Bug Bounty\"**","rules_html":"

About<\/h2>\n

ZECIBLE<\/h3>\n

ZECIBLE is a company that delivers many services to its customers. Security is very important to us and this Bug Bounty program shall help us meet highest industry standards to offer the most secure service and experience to all parties.<\/p>\n

Program Rules<\/h2>\n

Testing Policy, Responsible Disclosure<\/h3>\n

Please adhere to the following rules while performing research on this program:<\/p>\n