Return to BUG-BOUNTY.md CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / curl / docs

Annotation of embedaddon/curl/docs/BUG-BOUNTY.md, revision 1.1

1.1     ! misho       1: # The curl bug bounty
        !             2: 
        !             3: The curl project runs a bug bounty program in association with
        !             4: [HackerOne](https://www.hackerone.com) and the [Internet Bug
        !             5: Bounty](https://internetbugbounty.org).
        !             6: 
        !             7: # How does it work?
        !             8: 
        !             9: Start out by posting your suspected security vulnerability directly to [curl's
        !            10: HackerOne program](https://hackerone.com/curl).
        !            11: 
        !            12: After you have reported a security issue, it has been deemed credible, and a
        !            13: patch and advisory has been made public, you may be eligible for a bounty from
        !            14: this program.
        !            15: 
        !            16: See all details at [https://hackerone.com/curl](https://hackerone.com/curl)
        !            17: 
        !            18: This bounty is relying on funds from sponsors. If you use curl professionally,
        !            19: consider help funding this! See
        !            20: [https://opencollective.com/curl](https://opencollective.com/curl) for
        !            21: details.
        !            22: 
        !            23: # What are the reward amounts?
        !            24: 
        !            25: The curl projects offer monetary compensation for reported and published
        !            26: security vulnerabilities. The amount of money that is rewarded depends on how
        !            27: serious the flaw is determined to be.
        !            28: 
        !            29: We offer reward money *up to* a certain amount per severity. The curl security
        !            30: team determines the severity of each reported flaw on a case by case basis and
        !            31: the exact amount rewarded to the reporter is then decided.
        !            32: 
        !            33: Check out the current award amounts at [https://hackerone.com/curl](https://hackerone.com/curl)
        !            34: 
        !            35: # Who is eligible for a reward?
        !            36: 
        !            37: Everyone and anyone who reports a security problem in a released curl version
        !            38: that hasn't already been reported can ask for a bounty.
        !            39: 
        !            40: Vulnerabilities in features that are off by default and documented as
        !            41: experimental are not eligible for a reward.
        !            42: 
        !            43: The vulnerability has to be fixed and publicly announced (by the curl project)
        !            44: before a bug bounty will be considered.
        !            45: 
        !            46: Bounties need to be requested within twelve months from the publication of the
        !            47: vulnerability.
        !            48: 
        !            49: The vulnerabilities must not have been made public before February 1st, 2019.
        !            50: We do not retroactively pay for old, already known, or published security
        !            51: problems.
        !            52: 
        !            53: # Product vulnerabilities only
        !            54: 
        !            55: This bug bounty only concerns the curl and libcurl products and thus their
        !            56: respective source codes - when running on existing hardware. It does not
        !            57: include documentation, websites, or other infrastructure.
        !            58: 
        !            59: The curl security team will be the sole arbiter if a reported flaw can be
        !            60: subject to a bounty or not.
        !            61: 
        !            62: # How are vulnerabilities graded?
        !            63: 
        !            64: The grading of each reported vulnerability that makes a reward claim will be
        !            65: performed by the curl security team. The grading will be based on the CVSS
        !            66: (Common Vulnerability Scoring System) 3.0.
        !            67: 
        !            68: # How are reward amounts determined?
        !            69: 
        !            70: The curl security team first gives the vulnerability a score, as mentioned
        !            71: above, and based on that level we set an amount depending on the specifics of
        !            72: the individual case. Other sponsors of the program might also get involved and
        !            73: can raise the amounts depending on the particular issue.
        !            74: 
        !            75: # What happens if the bounty fund is drained?
        !            76: 
        !            77: The bounty fund depends on sponsors. If we pay out more bounties than we add,
        !            78: the fund will eventually drain. If that end up happening, we will simply not
        !            79: be able to pay out as high bounties as we would like and hope that we can
        !            80: convince new sponsors to help us top up the fund again.
        !            81: 
        !            82: # Regarding taxes, etc. on the bounties
        !            83: 
        !            84: In the event that the individual receiving a curl bug bounty needs to pay
        !            85: taxes on the reward money, the responsibility lies with the receiver. The
        !            86: curl project or its security team never actually receive any of this money,
        !            87: hold the money, or pay out the money.
        !            88: 
        !            89: ## Bonus levels
        !            90: 
        !            91: In cooperation with [Dropbox](https://www.dropbox.com) the curl bug bounty can
        !            92: offer the highest levels of rewards if the issue covers one of the interest
        !            93: areas of theirs - and only if the bug is graded *high* or *critical*. A
        !            94: non-exhaustive list of vulnerabilities Dropbox is interested in are:
        !            95: 
        !            96:  - RCE
        !            97:  - URL parsing vulnerabilities with demonstrable security impact
        !            98: 
        !            99: Dropbox would generally hand out rewards for critical vulnerabilities ranging
        !           100: from 12k-32k USD where RCE is on the upper end of the spectrum.
        !           101: 
        !           102: URL parsing vulnerabilities with demonstrable security impact might include
        !           103: incorrectly determining the authority of a URL when a special character is
        !           104: inserted into the path of the URL (as a hypothetical). This type of
        !           105: vulnerability would likely yield 6k-12k unless further impact could be
        !           106: demonstrated.