Banner object (1)

4217 policies in database
  Back Link to program      
Hall of Fame


50 € 



3DS OUTSCALE, an IaaS Cloud provider, is looking for any security-oriented feedback. We used to limit this Bug Bounty program to our Client Administration Website (Cockpit) and part of our APIs, but now we are exposing (most of) our client accessible endpoints for your greatest pleasure (yes, including our Cloud resources)!

Want to know the target? It's simple! We want you to find any ways of accessing other people’s resources, or anything impacting their customer experience or the infrastructure itself!

Is that it? Are you enthralled? Are you ready to make your pentesting tools armada let out an enthusiastic roar?

Then read the rest of this page to avoid losing precious time and points by reporting Out of Scope vulnerabilities, and get to know us a bit more at the same time.

Hunter skills that will lead you to success:

  • Web, but you’d better be good as that's the most common.
    • Be prepared to attack APIs.
  • SecOps, as you'll need an understanding of how the Cloud works.
  • Network Security, as the golden nugget might very well be hidden inside our network.


06/09/2019 - New Rewards !


Founded in 2010, strategic partner of Dassault Systèmes and CMSP Advanced certified by Cisco Systems, 3DS OUTSCALE provides enterprise-class Cloud Computing services (IaaS) that meet regulatory and local requirements internally. 3DS OUTSCALE is committed to offer services that combine excellence and reliability, and offers solutions to clients seeking to boost their business agility and rapidly deploy value-enhancing business models. 3DS OUTSCALE counts 800 satisfied clients throughout the world as well as several hundred users working for well-known multinationals via Dassault Systèmes. 3DS OUTSCALE has received ISO security certification 27001-2013 for all its French locations.

3DS OUTSCALE develops its own Cloud orchestrator, TINA OS, with strong security requirements and which provides many additional products around this infrastructure.

3DS OUTSCALE Services Overview

As 3DS OUTSCALE is compatible with AWS EC2, our infrastructure has a similar architecture.

We have public websites ( which are not in the scope , and which are not part of our products.

We have several APIs aiming to manage specific resources in the Cloud:

  • You can find the extensive list here:
  • Each endpoint in the eu-west-2 region is in the scope of this bug bounty program.

We also have a web interface, Cockpit, built on top of our APIs, allowing our clients to interactively manage their resources in our Cloud:

  • This IS in the scope of this bug bounty program.

Our documentation can be found at the following locations:

    • Here, you will find all kinds of information on how to use our Cloud.
    • This is the API documentation. This is mostly useful when hunting for bugs in the API.

( Those ARE NOT in the scope. )

The points of focus for vulnerability must be on:

  • Confidentiality
  • Integrity
  • Traceability

The availability of the scope is not covered by this bounty program (denial of services is not allowed). Only exploitable vulnerabilities are covered.
A proof of concept must be provided in the report regarding vulnerabilities.
Customers with Cloud resources are not concerned by this bounty. Snapshots and images provided by 3DS OUTSCALE are not concerned either.

Keep in mind that this is a production environment: no data alteration is allowed inside 3DS OUTSCALE infrastructure or on 3DS OUTSCALE customers Cloud infrastructure. You must not affect the availability of the platform.

If you have any doubts on whether you can test something or not, or if you want to make sure you are allowed to do something specific, you can send us an e-mail at

Rewards and Process

3DS OUTSCALE will determine, at its discretion, whether a reward should be granted, and the amount of this reward. We may choose to pay higher rewards for severe vulnerabilities or lower rewards for vulnerabilities that are considered less severe. This is not a competition.

Our Security team will review each committed finding and contact you as soon as possible to reproduce and solve the reported vulnerability. Please allow 5 working days for our initial reply. We ask you to make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services during your research.

In case of problem, you can send an e-mail to
We are able to help you with the cloud itself ( if you need help understanding behaviors ), and are willing to help you move forward when you feel like you found something but fail to exploit it.

In Scope

Scope Type Scope Name

Any resource created or accessed with the Outscale Cloud








Out of Scope

Scope Type Scope Name

Social engineering of Outscale employees and contractors


Attack against Outscale offices (malware, backdoor, DoS, etc.)


Denial of service attacks


Vulnerabilities on products or services other than Cockpit or APIs


Issues in our DNS and NTP


Same behavior as Amazon Web Services


E-mail server configuration (DKIM/SPF/DMARC)


Other subdomains on (,, )


Issues not leading to confidentiality, traceability or integrity problems. You can report it to

This program have been found on Yeswehack on 2018-12-13.

FireBounty © 2015-2020

Legal notices