Bug Bounty Program – Public Disclosures

#010 – IDOR (Critical)

Identified IDOR allowing an attacker to delete any Policy Group across organizations by manipulating a numeric ID in the delete API request. Remediated by implementing proper authorization checks.

#008 – Authentication Bypass (Critical)

Identified 2FA bypass via response manipulation. Remediated as part of authentication system hardening.

#007 – Stored XSS (High)

Identified stored cross-site scripting vulnerability in snippet management feature. Demonstrated session cookie access. Remediated.

#009 – Email Change Logic Flaw (High)

Identified that a user’s email address could be changed without re-entering the current password, enabling potential account takeover via session hijacking. Remediated by adding re-authentication check.

#005 – Information Disclosure (Medium)

Identified unauthenticated Prometheus metrics endpoints exposing internal infrastructure details. No credentials or customer data exposed. Remediated.

#012 – Open Redirect / XSS (Medium)

Identified vulnerability in internal Grafana instances (CVE-2025-4123) that could lead to arbitrary JavaScript execution and session hijacking for targeted DevOps team members. Remediated by upgrading.

#001 & #002 – XML-RPC & CORS (Low)

Reported XML-RPC endpoint and permissive CORS configuration on marketing site. Limited impact due to no customer data on affected system. Combined bounty awarded.

#011 – Exposed Admin Interface (Low)

Reported phpMyAdmin setup wizard was publicly exposed. Classified as Low severity due to affecting the marketing website. Remediated.