Thank you for your interest in the Nivelo Bug Bounty Program. This document contains instructions on how to send us security reports.
We appreciate your help in making Nivelo as secure as possible by reporting potential issues to us. Thank you!
Nivelo Bug Bounty
At Nivelo, we take privacy and security seriously. We encourage security researchers to participate in our bug bounty program, which is meant for security researchers to responsibly find, disclose, and help us resolve security vulnerabilities.
Our program is straightforward and consists of a simple set of rules that help protect both our company and those who find bugs and security vulnerabilities.
How we approach security issues
- Nivelo will not take legal action against anyone for disclosing vulnerabilities within these guidelines.
- We strive to follow up promptly to all bug and vulnerability reports.
- At this time we are unable to compensate researchers for their efforts. We hope to do so in the very near future but in the interim we appreciate any help from the community.
Program Rules
- Do ensure testing only includes sites and services that Nivelo directly operates. Nivelo will not accept reports for 3rd party services or providers that integrate with Nivelo through our API. Please contact 3rd parties directly to inform them of vulnerabilities using their bug bounty programs.
- Don't perform any actions that could harm the reliability or integrity of our services and data. Some examples of harmful activities include: brute forcing, denial of service (DoS), spamming, etc.
- Do perform actions to prove the scope of a vulnerability using good judgement of what constitutes a demonstration of generalizable scope. Modifying a row in a database to prove SQL injection is a reasonable way to prove you obtained write access to data without destroying the database. It is easy to see how SQL injections can be elevated to performing arbitrary actions on the data (which includes deleting rows but is not necessary as a reasonable demonstration).
- Don't disclose information about issues found until Nivelo has completed our investigation and resolution. After confirmation, you are welcome to document and publish any information about the issues you've found in accordance with ethical exposure guidelines and using your good judgement.
Out of Scope Vulnerabilities
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are generally considered out of scope: