At Conclusion, we are committed to keeping our systems, network and product(s) secure. Despite the measures we take, the presence of vulnerabilities will always be possible. When such vulnerabilities are found, we’d like to learn of them as soon as possible, allowing us to take swift action to improve our security.
Always avoid to:
What to expect from us:
Please note that Conclusion technical staff will assess and categorize your
report, considering potential impact in the relevant context. Their assessment is not open for debate. We will only reward the first reporter of a vulnerability; duplicate reports will not be rewarded.
Here are some examples of critical vulnerabilities which we will reward with a Conclusion promotional article like a t-shirt or polo. Your name will, with your consent, be placed on our “Coordinated vulnerability disclosure Wall of Fame” and we will provide you with a personalized “Certificate of Appreciation”:
Access to internal systems, Access to sensitive business information, Access to privacy (personal) data, Remote code execution, SQL injection, Significantly broken authentication or session management, Stored XSS, CSRF and Privilege Escalation on critical functionality, Session takeovers
Here are some examples of vulnerabilities which we will reward with adding your name, with your consent, to the “Coordinated vulnerability disclosure Wall of Fame” and we will provide you with a personalized “Certificate of Appreciation”:
XSS (or a behavior) where you can only attack yourself, XSS on pages where admins are intentionally given full HTML editing capabilities (such as custom theme editing), open or covert redirects. direct object references to non-sensitive data, misuse of password recovery tooling to retrieve user account information, Access Control Bypass, Open URL Redirection, Directory Traversal, missing flags or settings in email servers or DNS records, missing HTTP headers without practical security impact, missing 404 pages, Brute-force/Rate-limiting/Velocity throttling and other denial of service-based issues, Clickjacking, Content spoofing issues without branding CSS. Cookie flags, Issues where the fix only requires a text change, Login/Logout CSRF, Malicious attachments on file uploads or attachments, Missing additional security controls, such as HSTS or CSP headers, Mobile issues that require a Rooted or Jailbroken device, Password recovery policies, such as reset link expiration or password complexity, Reflected File Download (this may be rewarded in the future, but is currently out of scope), SPF, DKIM, DMARC issues, IIS tilde directory enumeration, misconfigured debugging error pages or other method of retrieving information about file existence on a server without actual access to the contents of these files.