Overview
At TechOwl Shield, our utmost priority is the security of our products and services, and
the safety of your data, as well as ours. We understand that security is essential in
maintaining the trust you place in us to provide products and services to you.
As a team of enthusiastic security researchers, we are working vigilantly every day to
keep our customers’ information secure. But we at TechOwl Shield truly believe
nothing is completely secure, no matter how much effort we put in. Thus we welcome
responsible security researchers from the community to help us improve our products and
services and secure users’ data. We are eagerly looking forward to working with
skilled security researchers.
If you believe you have found a security vulnerability, irrespective of whether its
priority is low or critical, please privately send us your report and allow us 5–7
business days for acknowledgment. If the vulnerability is found to be legitimate, we
would love to work with you to address it as quickly as possible.
Rewards
As of now, we are not offering monetary rewards for any vulnerabilities. However, if your
submission is valid, we will send you a token of our appreciation in the form of an
“AWESOME SWAG.”
Scope
In-Scope Services
- Any products or services owned by TechOwl Shield.
Out-of-Scope Services
- Any 3rd party services.
- This website, as it is hosted on Webflow and comes under a 3rd party service.
- Staging domain of TechOwl Shield.
In-Scope Vulnerabilities
We are interested in the following types of vulnerabilities:
- SQL injections
- Privilege escalations
- Code executions
- File inclusions (local & remote)
- Authentication bypasses
- Leakage of sensitive data
- Administration portals without an authentication mechanism
- Open redirects that allow stealing tokens / secrets
- Cross-Site Request Forgery (CSRF)
- Cross-Site Scripting (XSS)
- Server-Side Request Forgery (SSRF)
- Protection mechanism bypasses (CSRF bypass, etc.)
- Directory traversal
Out-of-Scope Vulnerabilities
The types of vulnerabilities excluded include, but are not limited to:
- Self-XSS
- Tabnabbing
- Email spoof
- Content spoofing
- Missing cookie flags
- Best practices / issues
- Content injection
- Long string validation / DoS attacks
- Clickjacking / UI redressing
- HTTPS / SSL / TLS related issues
- Physical or social engineering attacks
- Login / logout / unauthenticated / low-impact CSRF
- Unverified results of automated tools or scanners
- No SPF / DMARC in non-email domains / subdomains
- Attacks requiring MITM or physical access to a user’s device
- Vulnerabilities affecting users of outdated browsers or platforms
- Error information disclosure that cannot be used for a direct attack
- Missing security-related HTTP headers that do not lead directly to a vulnerability
- Xmlrpc.php open to the public
- WordPress related user info disclosure
- Insecure CORS at wp-json endpoint and CVE-2018-6389
- User enumeration at different endpoints and rate limiting absence at different
endpoints
Exclusions
While researching, please refrain from:
- Testing forms hosted by an external party. All the “Request a
Demo” forms are hosted on HubSpot, and anyone testing on that
will be barred from participating in the vulnerability disclosure
program.
- Attempting to gain access to other accounts or data
- Distributed Denial of Service (DDoS)
- Impacting / affecting other users
- Spamming
- Social engineering or phishing of TechOwl Shield employees or contractors
- Any attacks against TechOwl Shield’s physical property or data centers
Rules of Engagement
When submitting potential vulnerabilities, please share the following attributes for it to
qualify as a valid submission:
- Description of the vulnerability
- Detailed steps to reproduce the vulnerability
- Supporting material
- Proof of concept
- Impact of the vulnerability
- Exploit scenarios
- Mitigation / patch, if available
Report
If you believe you’ve discovered a potential vulnerability, please submit your
findings in the correct template. We will acknowledge your email as soon as possible.