Bug Bounty Program

If you're a security researcher or believe you've found a vulnerability in one of our products, the Bug Bounty Program at Forex Factory allows you to submit vulnerability reports directly to us and receive a reward.

We believe responsible disclosure should be compensated fairly and encourage the security researcher community to hunt for, find, and report issues.

Scope

Reports can be submitted for endpoints that exist under the following domains:

• *.forexfactory.com
• *.cryptocraft.com
• *.energyexch.com
• *.metalsmine.com

The following aren't considered vulnerabilities and shouldn't be reported:

• Denial of service (i.e. overwhelming services with a high volume of requests)
• TLS configuration
• Email security configuration (e.g. SPF or DMARC)
• Host header injection
• Cookie security policies (e.g. Secure/HttpOnly flags)
• Weak password policy
• Session security / management policies (e.g. multiple sessions allowed)
• Email enumeration / brute-Force attacks
• Lack of email verification on account creation
• Insignificant requests lacking CSRF tokens
• Social engineering / phishing
• Cached information stored in clients

General Rules

• Using vulnerabilities to intentionally exploit users or damage products and services will disqualify you
• Only new vulnerabilities can qualify for rewards
• You must be the first to report a vulnerability to be qualified
• You may not disclose vulnerabilities publicly or to other 3rd parties before they are fixed
• You may not disclose communication with our internal team

Rewards

Rewards for vulnerabilities are determined based on several factors such as impact, risk, and severity. We use the following guidelines to help determine compensation:

• Critical: $5K–$10K (e.g. server-side attack, remote code execution with elevated privileges)
• High: $2.5K–$5K (e.g. server-side attack, remote code execution, SQL injection)
• Medium: $250–$1K (e.g. client-side attack, XSS exploit)
• Low: $100–$250 (e.g. client-side attack, minor XSS exploit)

After the reported vulnerabilities have been confirmed, we will review your submission to decide on the appropriate reward. We may elect to reward more at our discretion, such as in extreme circumstances or as a gesture of good faith.