Bug Bounty Policy

Description

As someone who regularly participates in bug bounties, it's only fair that my assets have a policy themselves.

Please feel free to report any bug found under the *.georgeom.net domain (unless stated below) or on my GitHub profile to [email protected].

Assets

All *.georgeom.net domains are valid (unless mentioned further down), but here's a list of my current assets:

• georgeom.net
• www.georgeom.net
• admin.georgeom.net
• direct.georgeom.net
• stegonline.georgeom.net
• mobsf.georgeom.net
• old.georgeom.net
• cipher.georgeom.net (webapp only, otherwise report to repl.it)
• gci.georgeom.net (webapp only, otherwise report to repl.it)
• cloud.georgeom.net
• kf2.georgeom.net

Out of Scope

The following bugs are out of scope:

• Real server IP discovery. The site is behind cloudflare for DNS, caching and WAF, not for IP masking. Hosts can only be accessed from cloudflare IPs anyway, and direct.georgeom.net simply points to the true server IP.
• Missing best-practice headers on sites (other than georgeom.net and www.georgeom.net).
• Non-critical issues on cloud.georgeom.net - issues should be reported to Nextcloud.
• Any email-related issues on an @georgeom.net email address.

Rewards

If anything is found that's P3 or above (according to the Bugcrowd VRT), I'll send some stickers your way and list your name on this page.