45466 policies in database
Link to program      
2018-12-12
2019-09-26
Cryptobox logo
Thank
Gift
HOF
Reward

Reward

100 € 

Cryptobox

What is Cryptobox?

Cryptobox provides businesses and organizations with a sharing and collaboration solution to secure internal and external exchanges, using end-to-end encryption.

You can securely access your documents from any device, control your data and costs with a scalable architecture and a patented security solution. Cryptobox can be deployed on premises, in the cloud or in a hybrid model depending on customer architecture requirements.

Security

Cryptobox has been qualified by ANSSI for use at the "restricted" level, and certified at the Common Criteria EAL3+ level.

Ercom is convinced that working with skilled security hunters around the globe is a relevant part of the flow remediation process dedicated to maintain a high security level.

Rules

What hunters must do

  • All our program rules must be agreed and complied by hunters.
  • All tests shall be done following the processes set by YesWeHack.
  • Ercom provides a dedicated test platform for vulnerability assessment at https://bounty.cryptobox.com. This is the only platform that shall be challenged.
  • Each hunter will get access to 2 accounts, so that hunters can try attacking one of their account from the other.

What hunters must not do

  • Tests not compliant with rules of YesWeHack will not receive any reward, and will be deemed illegal.
  • Hunters must not violate any local, state, national or international law.
  • Hunters must not attack other another accounts than one of theirs.
  • Hunters must not use social engineering attacks.
  • Hunters shall not use more than 1 GB per account.
  • All documents provided to the hunters are currently confidential and shall not be disclosed.
  • Hunters shall not publicly disclose the bug until Ercom has confirmed the bug is fixed. Even then they shall not make exploits publicly available unless required by law or with Ercom’s written permission.

Supported browsers

  • Current versions of Firefox, Chrome and Edge.

Supported apps

Note

Cryptobox is a product that can be deployed either on premise or in the cloud, with one platform being deployed for a given company. It is expected that users of a given Cryptobox platform have access to each other information. This includes the email address, first name, last name and public certificates. In the context of this bug bounty, we deployed one dedicated platform https://bounty.cryptobox.com for all hunters. As a consequence, please be aware that your account information (first name, last name, email) will be visible by all other hunters.

Rewards

Ercom will pay rewards at Ercom’s discretion for a serious and reproducible vulnerability. Submissions will be evaluated in regard to the impact of uncovered vulnerabilities to these assets. Hunters are responsible for any applicable taxes associated with any reward you receive. Any report that results in a change in our code base will be rewarded, at minimum, by a €100 reward. Only the first hunter who find a given vulnerability is eligible to get a reward.

Please note that we may modify the terms of this program or terminate it at any time.

In Scope

Scope Type Scope Name
android_application

https://bounty.cryptobox.com

ios_application

https://bounty.cryptobox.com

web_application

https://bounty.cryptobox.com

Out of Scope

Scope Type Scope Name
undefined

Testing any other system than https://bounty.cryptobox.com, in particular .cryptobox.com or .ercom.com.


This program can reward you in EUR, up to 5000 €.

FireBounty © 2015-2024

Legal notices | Privacy policy