Bounties and Eligibility
Bounties range from USD $25 to $1,000 and scale according to impact and ingenuity, from an unlikely low-sensitivity XSS to a deep, novel RCE. One per bug; first discovery claims it; ties break toward the best written report.
The following areas are most important to us:
- Strong auth (sign-in, sessions, OAuth, account recovery)
- Access control (bypasses, faults, CSRF, etc)
- Injection prevention (SQL, XSS, method args, etc)
The following areas are considered out of scope and not eligible for a bug bounty:
- Best practices concerns (we require evidence of a security vulnerability)
- Hyperlink injection on e-mails
- Rate limiting
- Vulnerabilities only affecting users of outdated or unpatched browsers and platforms
- Race conditions that don’t compromise the security of any user or Air Mail
- Reports about theoretical damage without a real risk
- The output of automated scanners without explanation
- CSRF with no security implications (like Login/logout/unauthenticated CSRF)
- Broken links
- Missing cookie flags on non-security sensitive cookies
- Attacks requiring physical access to a user’s device
- Missing security headers not related to a security vulnerability
- Reports of insecure SSL/TLS ciphers unless you have a working proof of concept
- Banner grabbing issues to figure out the stack we use or software version disclosure
- Open ports without a vulnerability
- Password and account recovery policies, such as reset link expiration or password complexity
- Disclosure of known public files or directories, (e.g. robots.txt)
- Reports of spam
- Username/e-mail address enumeration
- Presence of autocomplete attribute on web forms
- DNSSEC and DANE
- HSTS or CSP headers
- Host header injection unless you can show how a third-party can exploit it
- Reflected File Download (RFD)
- EXIF information not stripped from uploaded images
- Existing sessions not being invalidated
- DoS vulnerabilities based on submitting a large payload in an input field and triggering a 500 error
- DoS vulnerabilities based on unlimited password length (hint: the password length is not unlimited)
- DoS vulnerabilities based on lack of pagination or lots of user content slowing response times
- DoS vulnerabilities based on repeated submission of forms
- Using product features like signup/forgot-password to deliver messages to any e-mail address
- Typos, content inaccuracies, factual issues, or other editorial content errors
The scope of security reporting is also limited to our domain at airmail.news. No other domains are within this scope.
