<div class="box-warning">Please read our policy thoroughly, as it clarifies which type of security issues we will be able to reward. Only reports submitted through our contact form (accessible through the button at the bottom of this page) will be considered for a bounty reward.</div>
<p>At Doist, our bug bounty program is a critical component of our security efforts. If you've found a security issue that you believe we should know about, we'd love to work with you. Your efforts may be eligible for a monetary reward. </p>
<h2>Eligibility</h2>
<ul>
<li>You must be the first to report the issue in order to be eligible for bounty.</li>
<li>You must be available to supply additional information, as needed by our team, to reproduce and address the issue.</li>
</ul>
<h2>Program Rules</h2>
<ul>
<li>Follow <a href="https://hackerone.com/guidelines" target="_blank" rel="noreferrer nofollow noopener" data-target-href="https://hackerone.com/guidelines"><u>HackerOne’s disclosure guidelines</u></a>.</li>
<li>Delete any test data or accounts you have created as part of the research.</li>
<li>Don’t attack or interact with end-users.</li>
<li>Don’t engage with stolen user data, including credentials.</li>
<li>Don’t use automated scans or testing, including DoS attacks.</li>
<li>Don’t use social engineering attacks, such as phishing.</li>
<li>Don’t engage in physical testing of Doist employees or their equipment.</li>
</ul>
<div>
<div>
<br>Failure to comply with these rules results in immediate disqualification.</div>
<h2>Eligible Targets</h2>
<ul>
<li><a href="http://www.todoist.com">www.todoist.com</a></li>
<li><a href="http://www.twist.com">www.twist.com</a></li>
<li>Current versions of Todoist and Twist for Windows, macOS, Linux, iOS and Android</li>
</ul>
<div>
<h2>Submitting your report</h2>
<ul>
<li>Provide a detailed report including clearly reproducible steps, consequences, impact, any test accounts you may have used along with test data.</li>
<li>Make sure to report independent vulnerabilities in separate tickets.</li>
<li>Make sure to give your report a clear title that describes the vulnerability.</li>
<li>Your submission must include written instructions for reproducing the vulnerability. Any report without clear reproduction steps or that includes only a video POC may be ineligible for a reward.</li>
</ul>
<h2>Rewards</h2>
<div>You may be eligible to receive a monetary reward if:</div>
<ul>
<ul>
<li>You are the first person to submit a site or product vulnerability</li>
<li>The vulnerability is considered to be a valid security issue by our team</li>
<li>You have complied with all Program Rules</li>
</ul>
</ul>
<p> </p>
<p>All bounty amounts will be determined by our team, who will evaluate each report and assign a severity level that determines the amount of the monetary reward to be received. The severity levels are decided internally based on the type of vulnerability and potential impact. Below you can find an overview of samples for each severity level: </p>
<p> </p>
<div>
<h4>Severity level: None</h4>
<ul>
<li>Issues not related with security, such as non-200 HTTP response codes, application or server errors, etc.</li>
<li>Issues without a clear security impact, such as logged-out CSRF, missing HTTP security headers, SSL issues, password policy issues, or clickjacking on pages with no sensitive actions.</li>
<li>Issues affecting outdated applications or components, no longer in use or maintained</li>
<li>Issues affecting third-parties, such as third-party apps or services we use (e.g., Firebase, ZenDesk)</li>
<li>Issues involving Spam or Social Engineering techniques, such as SPF and DKIM, <span class="blob-code-inner blob-code-marker" data-code-marker="+">and <span class="x x-first x-last">lack of DNSSEC</span></span>.</li>
<li>Issues involving server information disclosure, <span class="x x-first x-last">namely `</span>X-Powered-by<span class="x x-first">` </span><span class="pl-k x">and</span><span class="x x-last"> `Server` </span>response <span class="x x-first x-last">headers. Exceptions may exist whenever disclosed information contains a server version with an associated <a href="https://www.redhat.com/en/topics/security/what-is-cve">CVE</a> disclosure</span>.</li>
<li>Issues involving server-side request forgery (SSRF) on services that perform active requests by design, unless it is proven that sensitive information can be leaked. </li>
<li>Bugs requiring exceedingly unlikely user interaction. (eg. account takeover through SSO login)</li>
<li>Reports that require privileged access to the target's devices or that are otherwise outside our control. These include but are not limited to: access to browser cookies and/or other tokens used to impersonate the user, access to user's email address, etc.</li>
<li>Clickjacking issues that occur on pre-authenticated pages, or the lack of X-Frame-Options, or any other non-exploitable clickjacking issues.</li>
<li>Missing rate limits, unless it can lead to an exploitable vulnerability.</li>
<li>Specific to client apps</li>
<ul>
<li>User data stored unencrypted</li>
<li>Lack of obfuscation</li>
<li>Runtime hacking exploits that involve manipulation of running code or its environment</li>
</ul>
</ul>
<p> </p>
<h4>Severity level: Low</h4>
<ul>
<li>Open redirections</li>
<li>Server misconfiguration or provisioning errors</li>
<li>Information leaks or disclosure excluding sensitive user data</li>
<li>Reflected XSS</li>
<li><span class="blob-code-inner blob-code-marker" data-code-marker="+"> <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content" target="_self"><span class="pl-e">Mixed content</span></a><span class="x x-first x-last"> </span>issues<span class="x x-first">, if the target URL doesn't respond with a '</span><span class="pl-c1 x">Strict-Transport-Security'</span><span class="x"> (aka </span><a href="https://developer.mozilla.org/pt-BR/docs/Web/HTTP/Headers/Strict-Transport-Security" target="_self"><span class="pl-e x">HSTS</span></a><span class="x">) header. The risk still exists but is limited to a single interaction per domain/subdomain (depending on HSTS value). In 2021 </span><a href="https://www.makeuseof.com/chrome-defaults-to-https/" target="_self"><span class="pl-e x">browsers</span></a><span class="x x-last"> have been transitioning to an HTTPS default, further mitigating this problem</span>.</span></li>
<li>Other low-severity issues</li>
</ul>
<p> </p>
<h4>Severity level: Medium</h4>
<ul>
<li>CSRF / XSRF</li>
<li>SSRF to an internal service</li>
<li>Stored XSS</li>
<li>Other medium-severity issues</li>
</ul>
<p> </p>
<h4>Severity level: High</h4>
<ul>
<li>Information leaks or disclosure including sensitive user data</li>
<li>Other high-severity issues</li>
</ul>
<p> </p>
<h4>Severity level: Critical</h4>
<ul>
<li>SQL injection</li>
<li>Remote code execution</li>
<li>Privilege escalation</li>
<li>Broken authentication</li>
<li>SSRF to an internal service, resulting in critical security risk</li>
<li>Other critical-severity issues</li>
</ul>
</div>
<div>
<div>
<table data-ace-table-col-widths="192;192;192;192;192;192">
<tbody>
<tr>
<td> </td>
<td>
<div dir="auto"><strong>None</strong></div>
</td>
<td>
<div dir="auto"><strong>Low</strong></div>
</td>
<td>
<div dir="auto"><strong>Medium</strong></div>
</td>
<td>
<div dir="auto"><strong>High</strong></div>
</td>
<td>
<div dir="auto"><strong>Critical</strong></div>
</td>
</tr>
<tr>
<td>
<div dir="auto"><strong>Todoist</strong></div>
</td>
<td>
<div dir="auto">$0</div>
</td>
<td>
<div dir="auto">$100</div>
</td>
<td>
<div dir="auto">$200</div>
</td>
<td>
<div dir="auto">$500</div>
</td>
<td>
<div dir="auto">$1000</div>
</td>
</tr>
<tr>
<td>
<div dir="auto"><strong>Twist</strong></div>
</td>
<td>
<div dir="auto">$0</div>
</td>
<td>
<div dir="auto">$50</div>
</td>
<td>
<div dir="auto">$100</div>
</td>
<td>
<div dir="auto">$250</div>
</td>
<td>
<div dir="auto">$500</div>
</td>
</tr>
</tbody>
</table>
</div>
<p>Vulnerabilities on our Android mobile app(s) may qualify for an additional bounty through the <a href="https://hackerone.com/googleplay" target="_blank" rel="noreferrer nofollow noopener" data-target-href="https://hackerone.com/googleplay"><u>Google Play Security Rewards Program</u></a>.</p>
<p>All bounties are paid out via PayPal. </p>
<p>Doist’s team retains the right to determine if the submitted vulnerability is eligible.</p>
<p>All determinations as to the amount of a bounty made by the Doist Bug Bounty team are final.</p>
<h2>Contact </h2>
<button href="https://doist.typeform.com/to/UGbNWdlc" target="_blank"> Submit a vulnerability </button>
<div>For any questions or updates about the status of your report and its resolution, you can send an email to security@doist.com. </div>
</div>
</div>
</div>

Doist bug bounty policy