Directly invites you to test their primary webapp and any other discoverable subdomains or attack surface that's part of *.sandbox.directly.com. Upon receipt of your report, we promise to review and address any security issues in a timely manner and to communicate with you during our investigation and upon resolution.
Please note that Directly is only looking for sandbox environment issues (nothing in production). If you go into production sites, your IP may get banned.

Thanks again for making Directly a safer place for our customers and experts by disclosing security issues responsibly! Good luck and happy hunting!

Rewards/ratings:

For initial ratings, this program will use the Bugcrowd Vulnerability Rating Taxonomy for the prioritization/rating of findings. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Scope and rewards

Program rules

This program follows Bugcrowd’s standard disclosure terms.

For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please email support@bugcrowd.com. We will address your issue as soon as possible.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.