Bolt.Earth Bug Bounty Program

At Bolt.Earth, we are committed to ensuring the security and reliability of our products and services. We value the contributions of ethical security researchers in identifying vulnerabilities and ensuring the security of our ecosystem. To uphold this commitment, we invite security researchers to participate in our Bug Bounty Program and help us with maintaining the highest security standards.

How to Submit a Report

Please send your vulnerability reports to bugbounty@bolt.earth preferably with the format shared below for a swift response. We will acknowledge receipt of your report within 7 business days and provide updates as we investigate and address the issue. Please ensure your report follows this format, as this enables swift response and remediation.

Submission Format:

  • Subject line: Bug Bounty: <Vulnerability Name> - <Vulnerability Severity>
  • To: bugbounty@bolt.earth

Email body:

Vulnerability Details:

  1. Vulnerability Summary:
  2. Vulnerability Severity:
  3. Description of Vulnerability:
  4. Detailed Report:
  5. Affected Asset (URL, IP, API or Product Name, Application Version):
  6. Steps to Reproduce:
  7. Proof of Concept (Code snippets, screenshots, or videos demonstrating the issue):
  8. Impact:
  9. Suggested Mitigation steps:

Bounty Hunter details:

  1. Full Name:
  2. Email Address:
  3. Mobile Number:
  4. Any Publicly identifiable profile (optional): LinkedIn, Twitter, Hackerone etc.

Rewards

We reward reports based on the severity of their impact on a case-by-case basis as determined by our security team.

Exceptional reports with detailed proof of concept and mitigation steps are more susceptible to receive higher rewards. Unique, hard-to-find vulnerabilities are prioritized over those with complex prerequisites or lower risk of exploitation.

We may reward more for unique, hard-to-find bugs and reward less for bugs with complex prerequisites that have lower risk of exploitation of our platforms or are more seen to be as good practices to be implemented.

Hall of Fame: Your name will be added to our Responsible Disclosure Hall of Fame, with your consent.

If multiple researchers report the same vulnerability, the reward will go to the first verified report.

Program Scope

Our Bug Bounty Program focuses on the following assets:

  1. Web Applications: bolt.earth and associated subdomains.
  2. Mobile Applications: Bolt.Earth apps available on iOS and Android platforms.
  3. APIs: Publicly accessible APIs provided by Bolt.Earth.
  4. Firmware:
    • Device firmware for all Bolt.Earth products.
    • OTA (Over-The-Air) update mechanisms.
    • Bootloaders and secure boot processes.
  5. Hardware:
    • Embedded systems and IoT devices provided by Bolt.Earth.
    • Hardware components directly related to device functionality and communication.
    • Physical access control systems or security mechanisms.

Note: Vulnerabilities found in third-party services are out of scope unless they directly impact the security of our assets.

Eligible Vulnerabilities

We consider the following types of vulnerabilities are eligible:

  1. Authentication Issues: Such as broken authentication or improper session management.
  2. Authorization Flaws: Including insecure direct object references (IDOR).
  3. Cross-Site Scripting (XSS): Both reflected and stored XSS vulnerabilities.
  4. Cross-Site Request Forgery (CSRF).
  5. Remote Code Execution (RCE).
  6. SQL Injection.
  7. Server-Side Request Forgery (SSRF).
  8. Security Misconfigurations: Such as improper security headers or misconfigured CORS policies.
  9. Firmware - Buffer Overflows, Secure Boot Violations, Insecure OTA Updates, Hardcoded Secrets, Side-Channel Attacks
  10. Hardware - Debug Port Access, Physical Tampering, Hardware Communication Protocols, Fault Injection Attacks, Emanation Security

Note: This list is not exhaustive; we welcome reports on any security issues that could compromise the integrity, confidentiality, or availability of our systems.

Exclusions

The following are considered out of scope for our Bug Bounty Program:

  1. Denial of Service (DoS) Attacks: Including both volumetric and application-layer DoS attacks.
  2. Social Engineering: Such as phishing attacks targeting Bolt.Earth employees or users.
  3. Physical Attacks: Any form of physical attacks against our infrastructure.
  4. Spam or Content Injection: Issues related to unsolicited content that do not pose a security threat.
  5. Vulnerabilities in Third-Party Services: Unless they have a direct impact on Bolt.Earth's security.

Disclosure Policy

We adhere to a responsible disclosure policy:

  1. Confidentiality: Do not disclose the vulnerability publicly or to any third party without our explicit written consent.
  2. Legal Compliance: Ensure that your testing and reporting comply with all applicable laws and regulations.
  3. Non-Disruption: Avoid any actions that could disrupt our services or compromise user data during your testing.

Frequently Asked Questions (FAQ)

  1. What happens after I submit a report?
    • We will acknowledge receipt within 7 business days and provide regular updates as we investigate and address the issue.
  2. Can I disclose the vulnerability after it is fixed?
    • Disclosure is subject to Bolt.Earth’s prior written consent.
  3. What if someone else reports the same vulnerability?
    • The reward will go to the first verified report.
  4. How are rewards determined?
    • Rewards are based on the severity, impact, and uniqueness of the vulnerability.

Thank you for contributing to the security of Bolt.Earth. Your efforts help us protect our users and improve our services.