Xoxoday Bug Bounty Program

1. Reach out to us at cs@xoxoday.com to raise a ticket, if you happen to notice any potential security issue whilst also meeting all the required criteria in our policy.
2. The validation of the reported issue in terms of severity & authenticity will be done by our security team in around 7 days.
3. Post validation, steps will be taken to fix the security issues in accordance with our security policies.
4. The owner of the ticket will be informed once the issue is resolved.

To be eligible for a reward, the following requirements must be met by you:

1. You must be the first person to raise that vulnerability issue.
2. The issue must impact any one of the applications listed under our defined scope.
3. The issue must fall under the Qualifying bugs listed.
4. Publishing of vulnerability information in the public domain is not allowed.
5. Any information about the vulnerability issue must be kept confidential until the issue is resolved.
6. No privacy policies set by Xoxoday can be violated performing security testing.
7. Modification or deletion of unauthenticated user data, disruption of production servers, or any form of degradation to user experience is completely prohibited.

Violation of any of these rules can result in ineligibility or removal from the Xoxoday bug bounty program.

1. Use only the identified channel cs@xoxoday.com to report any security vulnerability.
2. While raising the ticket, ensure that the description and potential impact of the vulnerability is clearly mentioned.
3. Detailed instructions on the steps to be followed to reproduce the vulnerability must also be included.
4. A Video POC can be submitted, wherever possible.
5. Preferred name to be used for recognition in our Hall of Fame section on the Bug Bounty Program page.

Bug Bounty rewards will be paid in the form of popular gift cards. The value of the gift card will depend upon the severity and quality of the bug.

The final decision on bug eligibility & rewarding will be made by Xoxoday. The program exists completely at the firm’s discretion and has the provision to be canceled at any time.