Expectations

You can edit text on your website by double clicking on a text box on your website. Alternatively, when you select a text box a settings menu will appear. your website by double clicking on a text box on your website. Alternatively, when you select a text box When working with us according to this policy, you can expect us to:

• Extend Safe Harbor for your vulnerability research that is related to this policy;
• Work with you to understand and validate your report, including a timely initial response to the submission; and
• Work to remediate discovered vulnerabilities in a timely manner

General Exclusions

• Spam, social engineering and physical intrusion.
• DoS/DDoS attacks or brute force attacks.
• Vulnerabilities that are limited to non-current browsers.
• Attacks requiring physical access to a victim’s computer/device, man in the middle or compromised user accounts.
• Recently disclosed zero-day vulnerabilities in commercial products where no patch or a recent patch is available.
• Reports that state that software is out of date/vulnerable without a proof-of-concept.

Restrictions and Limits

Program Rules

• Submissions to this program should be submitted here. Submissions must include written instructions for reproducing the vulnerability. Submissions without clear reproduction steps may be ineligible for a reward.
• Automated testing/scanning must be kept under 60 requests per minute.
• Make a good faith effort to avoid privacy violation, disruption of service and destruction of data.
• Avoid submitting offensive content to the platform.
• Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, may be excluded or be lowered in severity.
• This program does not allow disclosure. You may not publicly disclose information about vulnerabilities found in this program without explicit written permission from Vartopia
• Do not perform any tests that will disrupt services or impair others’ ability to use those services.
• If a vulnerability provides unintended access to data, do not access the data beyond the minimum extent necessary to effectively demonstrate the presence of a vulnerability.
• If you encounter any sensitive data during testing such as Personally Identifiable Information (PII), or other confidential information, stop and submit a report immediately.
• Testing must not violate any applicable laws.
• In case that a reported vulnerability was already known, it will be flagged as a duplicate.

General Exclusions​

• Spam, social engineering and physical intrusion.
• DoS/DDoS attacks or brute force attacks.
• Vulnerabilities that are limited to non-current browsers.
• Attacks requiring physical access to a victim’s computer/device, man in the middle or compromised user accounts.
• Recently disclosed zero-day vulnerabilities in commercial products where no patch or a recent patch is available.
• Reports that state that software is out of date/vulnerable without a proof-of-concept.