Bug Bounty Program

Table of contents

1. Objective

The Bug Bounty Program aims to enhance the security of our services and Survicate tool by incentivizing security researchers and ethical hackers to report potential security vulnerabilities responsibly, to improve the security for all users by eliminating vulnerabilities. 

2. Requirements

  1. Participants must not publicly disclose the reported vulnerability.
  2. You must be at least 18 years old and possess full legal capacity.
  3. Current or former employees of Survicate (or families of those) are excluded.
  4. Abide by all relevant legal and ethical guidelines. 
  5. Reported in good faith and must not involve any malicious intent; refrain from any actions that may be considered invasive.
  6. Efforts made to attempt to gather information about vulnerabilities are not rewarded.
  7. You are not an individual from countries subject to sanctions.

3. Scope of the Program

  1. Survicate Bug Bounty Program covers all online services and applications provided by Survicate SA,
    1. in scope hosts:
      1. panel.survicate.com
      2. panel-api.survicate.com
      3. survey.survicate.com
      4. surveys-static.survicate.com
      5. surveys-static-prd.survicate-cdn.com
      6. respondent.survicate.com
    2. in scope apps:
      1. iOS SDK
      2. Android SDK
      3. React Native SDK
      4. Flutter SDK
      5. JavaScript SDK
      6. Panel - panel.survicate.com 
      7. Data Export API v2 only
      8. Webhooks

All domains and endpoints not listed in the targets section are out of scope.

4. Out of Scope 

Vulnerabilities in the following areas are out of scope and will not be eligible for Rewards:

  1. Vulnerabilities in third-party applications or libraries that are not developed by Survicate.
  2. Exploitation of known vulnerabilities that depend on outdated user software, such as outdated browsers or operating systems.
  3. Attacks such as Distributed Denial of Service (DDoS).
  4. Vulnerabilities related to third-party APIs.
  5. Brute-force attacks to uncover credentials​.
  6. Issues involving social engineering, phishing, or other tactics unrelated to the technical security of Survicate's systems​.
  7. Issues with DNS records (SPF, DKIM, DMARC) or SSL/TLS certificate configuration​.
  8. Low-severity vulnerabilities such as content spoofing or OWASP Low category issues​.
  9. Cross-Site Request Forgery (CSRF) vulnerabilities on non-sensitive areas of the platform.
  10. Discovery of publicly available information that does not pose a security threat.
  11. Security issues stemming from misconfigured external services or infrastructure not directly controlled by Survicate.
  12. enumeration of accounts and other resources,
  13. e-mail flooding/bombing
  14. Vulnerabilities that have been independently detected by Survicate or reported as part of other report submissions of the same or similar nature. Similarity means the use of the same or a similar methodology or pattern, or if the mitigation measures previously applied or planned by Survicate (in the context of other vulnerabilities) will also secure the reported vulnerability.
  15. Circumventing business plan limits defined in Survicate's pricing and using features without paying for them, including Paywall Bypass attacks.

5. Reporting Procedure

  1. Vulnerabilities must be reported via email to security@survicate.com.
  2. Reports should include
    1. detailed information about the Vulnerability, 
    2. steps to reproduce the issue, and 
    3. potential security impact. 
  3. Survicate may request additional information or proof of concept. 
  4. Survicate will respond to the reporter within 30 business days. 

6. Rewards

  1. Rewards will be determined by the Survicate based on the severity of the Vulnerability and its impact on the security of Survicate systems.
    ‍
    • Critical: up to PLN 5,000 or proper equivalent in USD 
    • High: up to PLN 2,000 or proper equivalent in USD 
    • Medium: up to PLN 1,000  or proper equivalent in USD 
    • Low: up to PLN 100 or proper equivalent in USD 
  2. Amounts are determined based on the 'CVSS Methodology' as an individual assessment in specific cases. 
  3. Receive a Reward if You are the first to report the specific vulnerability. If the vulnerability has already been reported by someone else who received a reward, no additional Reward will be granted
  4. The Reward pool is limited.

7. Survicate Bug Bounty Program

Terms →