Banner object (1)

Hack and Take the Cash !

851 bounties in database
  Back Link to program      
30/06/2015
Twilio logo
Thanks
Gift
Hall of Fame
Reward

Reward

Twilio

Ensuring the security and integrity of the Twilio platform is critical to the service we provide to our customers. We are committed to providing a secure product and appreciate help from the community in responsibly identifying ways for us to improve Twilio. We will make an effort to respond as fast as possible.

Rules of Engagement

  • Bounties are awarded differently per product (see below for more details on payouts).
  • Network Level DDoS/DoS attacks are forbidden. Application volumetric DDoS/DoS attacks are forbidden, if you find a request that takes too long to answer report it, please do not try to DoS the service.
  • Interacting with real customers is forbidden.
  • To prevent being locked out please throttle automated testing
  • Please note, if you think you have found a problem but cannot prove it without accessing Twilio's Internal Systems, please submit your finding and we'll be happy to work with you for validation.
  • Please ensure that you use your @bugcrowdninja.com email address when creating accounts and testing
  • While creating any assets please use bugcrowd--

For the initial prioritization/rating of findings, this program will use theBugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Rewards:

Category | Primary | Secondary | Other
---|---|---|---
P1 | $3,000 - $8,000 | $500 - $1,000 | $100 - $200
P2 | $1000 - $2,500 | $200 - $500 | Kudos -$100
P3 | $200 - $400 | $100 - $200 | N/A
P4 | $100 - $150 | Kudos | N/A

Target Overview

Primary Targets

Secondary Targets

Other Targets

Any host/web property verified to be owned by Twilio (domains/IP space/etc.) but not listed in Primary or Secondary targets and not listed as Out of Scope.

NOTE: If a submission falls under Secondary or Other targets, and has a significant impact, bounty may be increased at Twilio’s discretion.

Targets

In scope

Target name | Type
---|---
*.authy.com | Other
api.twilio.com | API
*.twilio.com | Website
*.flex.twilio.com | Website
Twilio APIs | API
Authy iOS Application | iOS
Authy Android Application | Android
Twilio CDNs (static*.twilio.com) | Other
Twilio Helper Libraries | Other
tsock.us1.twilio.com | Other
*.sip.*.twilio.com | Other
Twilio WebRTC Client | Other
build.twilio.com | Website
Twilio Wireless | Other

Out of scope

Target name | Type
---|---
All Third party hosted services, such as support.twilio.com are explicitly out of scope. | Website
Ytica and its assets | Website
Authy Desktop App | Other
TwimlBins | Other
store.twilio.com | Website
Demo websites e.g. lab.authy.com | Website
All Kurento domains | Website
twiliotraining.com | Website
www.twilio.com/labs | Website
www.twilio.com/quest | Website
SendGrid and its Assets | Website

Focus Areas

Core Twilio Products
Twilio Console
Twilio APIs
SIP
Video
Twilio WebRTC Client

Excluded Submission Types

  • "Session too long," password reset/change logout or other intended business functionality
  • All Wordpress-related findings
  • Flash findings that require Flash to be enabled
  • OpenVBX related findings
  • Subdomain takeovers of TLD's used for demo or test purposes [such as companyfoo.com]
  • Cookie valid after password change/reset
  • Forgot password auto-login
  • Denial of service or rate limiting issues
  • Resource Exhaustion attacks
  • Login or Forgot Password page brute force and account lockout not enforced
  • Non-existent or weak captcha / captcha bypass
  • Email validation not enforced
  • Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
  • SSL/TLS Issues such as:BEAST, BREACH, SSL insecure cipher suites enabled.
  • Vulnerabilities that are limited to older/unsupported browsers
  • Known vulnerabilities in libraries used by Twilio, usage of an outdated third party library (e.g. jQuery, Apache etc) unless you can prove exploitability.

Public Disclosure

Twilio does not permit public disclosure at this point in time.

Twilio Safe Harbor

We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy. We consider activities conducted consistent with this policy to constitute “authorized” conduct under the Computer Fraud and Abuse Act. To the extent your activities are inconsistent with certain restrictions in our Acceptable Use Policy, we waive those restrictions for the limited purpose of permitting security research under this policy. We will not bring a DMCA claim against you for circumventing the technological measures we have used to protect the applications in scope.
If legal action is initiated by a third party against you and you have complied with Twilio's bug bounty policy, Twilio will take steps to make it known that your actions were conducted in compliance with this policy.
Please submit a BugCrowd report to us before engaging in conduct that may be inconsistent with or unaddressed by this policy

Program rules

This program follows Bugcrowd’s standard disclosure terms.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.

In Scope

Scope Type Scope Name
android_application

Authy Android Application

api

Twilio APIs

ios_application

Authy iOS Application

other

Twilio Helper Libraries

other

Twilio WebRTC Client

other

Twilio Wireless

web_application

*.authy.com

web_application

api.twilio.com

web_application

*.twilio.com

web_application

*.flex.twilio.com

web_application

Twilio CDNs (static*.twilio.com)

web_application

tsock.us1.twilio.com

web_application

build.twilio.com

web_application

.sip..twilio.com

Out of Scope

Scope Type Scope Name
other

Authy Desktop App

other

TwimlBins

web_application

store.twilio.com

web_application

Demo websites e.g. lab.authy.com

web_application

All Kurento domains

web_application

twiliotraining.com

web_application

www.twilio.com/labs

web_application

www.twilio.com/quest

web_application

SendGrid and its Assets

web_application

All Third party hosted services, such as support.twilio.com are explicitly out of scope.

web_application

Ytica and its assets


This program can reward you in USD, up to 8000 $.

FireBounty © 2015-2019

Legal notices