Bug Bounty

For those who have taken the time to reveal potential vulnerabilities within our platform we will pay a bounty loosely based on the following pricing template:

When you are testing, please follow these rules:

1. Any testing must be limited to a maximum of one request per second to prevent the potential overload of the NestForms service.
   
2. We do not allow BugBounty hunters to download database content. A list of the tables is enough for proof of concept.
3. You will need to create a NestForms account for testing the service. Always add “BugBounty” as part of the name when registering to confirm your link to the Bug Bounty program.
   
4. We do not accept bugs that affect outdated browsers, user agents or app versions.
   
5. The primary focus of the NestForms Bug Bounty program applies to nestforms.com, www.nestforms.com and s3-eu-west-1.amazonaws.com/files.nestforms.com domains only.
   We may (circumstances depending) accept bounty reports to related domains (staging.nestforms.com, analytics.nestfoms.com, ...) but it must be stressed that they are not the primary focus of the Bug Bounty program and do not contain critical client data. As a result the accepted bounties are lower than main domain bugs that are found and reported. NestForms does not include or accept responsibility for any third party associations with NestForms.com.
   
6. For the protection of our customers, NestForms requests that you not post or share any data regarding potential vulnerabilities on other public platforms until NestForms have investigated, taken action, researched, responded to, and addressed the reported vulnerability issue and informed customers if needed.
7. We require that you operate within the guidelines of our Terms & Conditions.
8. Always use email addresses that belong to you. Violations of this rule may end up in a reduced or no bounty reward due to potential damage to our business offering.
9. Our Staging server has disabled sending emails, therefore some of the features are not available (e.g.: invite members by email, email triggers, forgot password, confirm email, etc.).

We are aware of several niche areas that might be considered as a vulnerability, but as our service is narrow in focus, the following scenarios are not considered as a bug or vulnerability to NestForms, so please do not report these issues:

1. Denial of Service (DoS) attacks.
2. Distributed Denial of Service (DDoS) attacks.
3. Any variant of Phishing or Social Engineering.
4. Any physical action outside the realm of a web based attack.
5. Rules restricting the free account on downgrade. Our business decision is to make it smooth to upgrade again, so we allow users to use more resources than available in free for a short period of time eg. number of shared relations within a form, already uploaded images, responses that already exist in their master account.
6. Finding the ID of any record without revealing any private information, updating or deleting the record.
7. Double extension uploaded files without proof of exploit.
8. Non validation of emails is a business decision where we allow any user to create an account without email confirmation in order to maintain a simplicity of use.
9. More precise messages on whether the email already exists in our database (within forgot password, registrations, etc) is a NestForms business decision. We are limiting the number of tries for these occasions which are effectively blocking our database scanning. BTW: a similar concept is applied by google as well.
10. Creating multiple NestForms accounts using one Gmail account (eg: using a plus symbol in the email address).
11. We are not responsible for third party software that may or may not be associated with NestForms (eg analytics.nestforms.com).
12. Android or iOS NestForms app.

Please review our guidelines below in order to assist you when submitting an effective bug report:

• Give a short clear description summarising the issue you have found.
• Information on how you uncovered and exploited the issue.
• Proof of how the issue can be exploited to work against the NestForms platform.
• Please describe the impact of how an attacker could exploit the reported issue in order to show how it would affect our operations.
• Any other information and attachments such as screenshots or videos showing the threat or vulnerability that you would consider helpful. 
• Any information you believe pertinent with regards to device or platform is welcome.

The guidelines above are not comprehensive and the awarding of bounties are very much based on how accurate the reporting of the vulnerability may be. So please remember to be precise in your submission, it can take time for issues to be investigated so reports that are unclear or vague may not be considered.

For submission, please use our secure submission described in .well-known/security.txt on our website. Or alternatively you can use our contact form.

1. We will acknowledge receipt of your submission as soon as possible.
2. We will not be able to reward any reported findings immediately as we will have to carry out our own investigation into the issue. We always aim to respond within one week. 
3. We can only award one bounty per issue reported. 
4. The first clear bug report will receive the finders award in case there have been multiple submissions on the same issue.
5. To receive a bounty, you must reside in a country that is not on any official sanction list (e.g., Cuba, Iran, North Korea, Sudan & Syria). NestForms reserves the right to cancel or amend the bug bounty program. It is at our discretion whether or not to pay an award.
6. Please be patient once you have submitted your report. We make every effort to check all reports very carefully. Depending on levels of activity, it can take between 1-5 working days for our team to respond to your submission. The same applies to any follow up email thread. Excessive follow up emails may end up causing a reduced bounty due to additional workload for our support team. However, if we have not responded within 7 days. Do resend your request.
7. When we confirm the reported vulnerability and assign the associated bounty amount, we will ask you to provide your bank account in order to transfer money via electronic international payment. Payment will usually appear within 14 days of vulnerability confirmation by NestForms.