Out-of-Scope

• Subdomain takeover without actual proof
• Account harvesting (e.g. enumerating WordPress usernames)
• Access to keys and credentials without proof that they are valid
• UUID enumeration of any kind.
• SSL Pinning
• Invite/Promo code enumeration.
• Reports that state that software is out of date/vulnerable without a proof-of-concept.
• Stack traces, path disclosure, and directory listings.
• CSV injection.
• Best practices concerns.
• Highly speculative reports about theoretical damage -- please always provide a proof-of-concept.
• Vulnerabilities that cannot be used to exploit other users or Funding Societies -- e.g. self-xss (having a user paste JavaScript into the browser console).
• Most vulnerabilities within our sandbox or staging environments.
• Vulnerabilities as reported by automated tools without additional analysis as to how they're an issue.
• Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated.
• Distributed denial of service attacks (DDOS) or any activity that will cause service disruptions..
• Content injection issues.
• Cross-site Request Forgery (CSRF) with minimal security implications (Logout CSRF, etc.)
• Missing cookie flags on non-authentication cookies.
• Email Spoofing.
• Missing HTTP security headers.
• Lack of HTTPOnly and Secure cookie flags.
• Issues that require physical access to a victim’s computer/device.
• SSL/TLS scan reports (this means output from sites such as SSL Labs).
• Banner grabbing issues (figuring out what web server we use, etc.).
• Open ports without an accompanying proof-of-concept demonstrating vulnerability.
• Broken Link Hijacking.
• Entering the Funding Societies offices, throwing crisps everywhere, unleashing a bunch of hungry raccoons, and hijacking an abandoned terminal on an unlocked workstation while staff are distracted.(social engineering etc )
• Reports that affect only outdated user agents or app versions -- we only consider exploits in the latest browser versions for Safari, FireFox, Chrome, Edge, IE and the versions of our application that are currently in the app stores.
• Lack of rate-limiting on API endpoints, unless it is for brute-forcing of a pass token with insufficient entropy (e.g. 4 digit passcode without invalidation and rate-limiting)
• Vulnerabilities found in rooted mobile devices
• Open redirects. 99% of open redirects have low security impact. For the rare cases where the impact is higher, e.g., stealing oauth tokens, we do still want to hear about them.