• Security
  • Bug Bounty Program / Report a Bug

Responsible Disclosure / Report a Bug

Security of user data and communication is of utmost importance to us. With the best possible security of our service in mind, we welcome responsible disclosure of any vulnerability you find in our products, services, apps or websites. The principles of responsible disclosure include but are not limited to:

  • Accessing, exposing or attempting to exploit only data that is your own.
  • Avoid scanning or similar techniques that are likely to cause degradation of service to our systems or other customers (e.g. by overloading or overwhelming our services)
  • Keeping details of vulnerabilities secret and confidential until we have been notified and have had a reasonable amount of time to correct or fix the vulnerability. You must not disclose the vulnerability to any third party or post details anywhere else until resolved.
  • Keeping within the limits and guidelines contained in our Terms of Service.
  • You must agree to follow the guidelines below and standard industry disclosure guidelines:
    • Respect the rules. Operate within the rules set forth by the Security Team, or speak up if in strong disagreement with the rules.
    • Respect privacy. Make a good faith effort not to access or destroy another user’s data.
    • Be patient. Make a good faith effort to clarify and support their reports upon request.
    • Do no harm. Act for the common good through the prompt reporting of all found vulnerabilities. Never willfully exploit others without their permission.
  • We agree to follow the guidelines below and :
    • Prioritize security. Make a good faith effort to resolve reported security issues in a prompt and transparent manner.
    • Respect Finders and Researchers. Give finders and researchers public recognition for their contributions.
    • Reward research. Financially incentivize security research when appropriate.
    • Do no harm. Not take unreasonable punitive actions against finders, like making legal threats or referring matters to law enforcement if properly and responsibly disclosed.

We use the following guidelines to determine the validity of submissions and the corresponding reward compensation offered:

  • Reproducibility
    • Our engineers or third party code authors must be able to reproduce the security flaw from your report. Vague or unclear reports are not eligible for reward. Reports or submissions that include detailed explanations and working code are most likely to earn rewards.
  • Severity
    • We are most interested in vulnerabilities in security that can be exploited to gain access to user data or services. We will only qualify and reward you if the bug can be successfully used by itself or in combination with another vulnerability you report to access user data that is not yours. General “bugs” are never qualified as vulnerabilities, and anything that is not a exploit is considered a general “bug”. The exploit must rely only on vulnerabilities of our systems
  • Examples of Qualifying Vulnerabilities
    • User / Authentication Flaws
    • Cross-site scripting (XSS)
    • Circumvention of privacy / permission models / priviledge escalation
    • Server-side code execution / Remote code execution
    • SQL Injection
    • Cross-site request forgery (CSRF/XSRF)
    • Source code vulnerabilities
  • Examples of Non-Qualifying Vulnerabilities
    • Failures to adhere to “best practices” (e.g. common HTTP headers, password policy or link expiration)
    • DOS – Denial of Service Vulnerabilities and social engineering attacks do not qualify and must not be attempted against our sites or users under any circumstances
    • Bugs related to unpatched, out of date or rarely used browsers or other software out of our control
    • Insecure cookies on our domains
    • Mixed-content scripts or mixed content warnings on our domains
    • Possibilities to send malicious links to people you may know
    • Possibilities of injecting sanitized / stripped html into comments / fields
    • Security flaws or bugs in third-party websites or third-party plugins that integrate with our sites, apps or services
    • Vulnerabilities that require a potential victim to install software that is non-standard or otherwise take steps to make themselves vulnerable
    • Social engineering or spam techniques
    • Front-end “XSS” from custom post types on our WordPress sites / entities. WordPress intentionally allows certain users to enter unfiltered HTML into posts (including custom post types) and comments. It will be escaped within the Administration Panels as a precaution, but displayed raw on the front-end. Other lower level users are not trusted and will not reproduce the same behavior. For more information, please read WordPress’ security FAQ

Rewards – NOTE Currently The Bug Bounty / Recognition Program is Limited In Scope

  • Only 1 (one) reward, bounty or recognition will be awarded per vulnerability.
  • In order to be eligible for a reward, bounty or recognition, your submission or responsible disclosure must be accepted as valid by us.
  • If we receive multiple reports for the same vulnerability, even if found on separate areas, only the person providing the first clear report will receive a reward and/or bounty.
  • We maintain total flexibility with our reward and or bounty system.  We have no set minimum/maximum amount; rewards are based on impact, severity, and report quality.
  • Our typical minimum bounty is an acknowledgement / kudos.
  • Our typical maximum bounty is an acknowledgement / kudos.
  • Sometimes third party developers will contribute additionally to the bounty / reward on a case by case basis and depending on the severity. This may increase the bounty and funding timeline if they contribute but there are no guarantees.
  • This is a discretionary program and we reserve the right to cancel or suspend the program at any time; the decision whether or not to pay any bounty or reward is at our discretion.
  • To receive a reward or bounty, you must reside in a country not on sanctions lists (e.g., Iran, North Korea, Sudan & Syria).
  • Rewards if funded are paid through Paypal, Dwolla or other method at our discretion and as permitted by law.
  • Our Bug Bounty Fund has very limited funding per week so please be advised your bounty payout may be delayed at times due to number of bugs reported, severity of bugs and Bug Bounty Fund available (sometimes months of delay). We will work to address and reward higher priority bugs first and will pay out bounties per priority, date reported and as funds become available.
  • You Must Practice Patience as our support team works through the issues by priority and funding available!

Hall of Fame – Kudos & Rewards

Our thanks to the following security researchers for their submissions: 


Contacting Us / Report a Bug

Please use the bug reporting form below email us at support [at] mceprocess.com with any reports of vulnerability or questions about the bug bounty program. If you email, please report each new bug in a separate form or email thread so we can ensure you are rewarded properly.

Bug / Issue Report Form

  • The severity of a bug generally reflects the potential harm that could occur if a bug was successfully exploited.
  • NOTE: Please use private or unlisted http://pastebin.com/ link below for your code submissions as html and other text may be sanitized / stripped here.
  • Drop files here or

    Accepted file types: jpg, png, pdf, jpeg, mov, mp3, mp4, 3gp, m4a, aac.

  • Getting In Touch

    Please provide you contact below so we can reach out or properly reward you for responsibly reporting a bug. You may also reach out to us: support@mceprocess.com








  • This field is for validation purposes and should be left unchanged.

 

 

Close Menu
Quick Quote

 

 

  • (required)
  • (required)
  • This field is for validation purposes and should be left unchanged.
×
Product Quote
×
Partner Link from Page

Share & Make Money – MCE Partner Program

You must be an active Partner and Logged In.

×
  • Please tell us your target price, best offer or lowest price found for this item.
  • Accepted file types: jpg, gif, png, pdf, doc, docx, xls, xlsx.
  • This field is for validation purposes and should be left unchanged.
×
  • Accepted file types: jpg, png, pdf.
    Upload or Take a Picture on Your Phone / Device
  • OPTIONAL: Enter email here if you would like a reward for your photo. Your email stays private with us and will never be shared.
  • This field is for validation purposes and should be left unchanged.
×
  • Stories posted on our site will receive a bounty / store credit. The best stories with good pictures earn up to $150 bounty / store credit.
  • Enter your email here if you would like a reward for your photo / application story. Your email stays private with us and will never be shared.
  • A short description of your application or problem solved with the product.
  • Accepted file types: jpg, png, pdf, doc, docx.
    Optional: Upload File or Take a Picture on Your Phone / Device
  • This field is for validation purposes and should be left unchanged.
×
×
×

Cart