Security

Responsible disclosure & bug bounty policy

Find a vulnerability in ProxyJolt and we want to hear about it. Scope, what pays, what doesn't, and how to report are all on this page, so no one gets surprised.

Scope

In scope

This website, proxyjolt.com
The customer dashboard behind your login, and its API
Rotation links, API keys and proxy credentials and how the dashboard handles them

Out of scope

Proxy gateways, modem hosts and the mobile carrier networks they ride on
Third parties: payment processors, Telegram, Cloudflare, email providers
Marketing assets served from legacy CDN paths
Customer accounts or data that aren't yours

What we pay

Show impact on our systems or our customers, and that is what gets rewarded. Amounts are in USD.

Critical

$100 – $250

Remote code execution on our servers
SQLi reading or writing customer data
Skipping authentication to reach any account without its credentials
Payment or balance hacks that score proxies, credit or refunds without paying
Other customers' proxy credentials or personal data exposed in bulk

High

$50 – $100

Reading or editing another customer's proxies, orders or account info via IDOR
Stored XSS firing in another customer's or an admin's session
Jumping from a customer account to admin functions via privilege escalation
Server-side request forgery reaching internal services
Stealing someone else's API key, rotation link or session

Medium

$20 – $50

CSRF hitting an action that changes account state
Reflected XSS that needs a victim's click on a link
Beating a rate limit all the way to a demonstrated account takeover
Pricing or business-logic errors with financial impact shown

Low / Informational

Acknowledged, fixed if warranted, not paid. Check the full list below first, then write the report.

What we do not pay for

These top out at Low or Informational. We read them, fix what's worth fixing, and pay no bounty, even with a Critical or High label on the report.

Sessions surviving a logout, password reset or password change until the token runs out
“Weak” or missing CSP, HSTS, X-Frame-Options or Referrer-Policy headers with no working exploit
Clickjacking on pages with no sensitive action
Attributes on cookies that aren't session ones
Email or username enumeration, even by timing or error messages
Login, forgot-password or rate-limit notes with no account takeover shown
Password policy takes: length, complexity, common-password lists, no forced rotation
No two-factor authentication, or 2FA only optional
Self-XSS, or XSS only the attacker can set off in their own session
CSRF on login, logout, language and other low-stakes forms
Open redirects leaking no token or credential
Version, banner, stack trace or path leaks with no sensitive data
SPF, DKIM or DMARC configuration reports
Auto-scanner output without a proof of concept
Denial of service, resource exhaustion, brute force or any test that adds load
Phishing or social engineering our staff or customers; physical attacks
Third-party problems: payment processors, Telegram, Cloudflare, email providers we use
Old libraries with no exploit that works on our deployment
Attacks that need a rooted phone, a hacked device or a man-in-the-middle position
Best-practice tips, theoretical risks and dupes of known issues

Rules of engagement

First valid report wins. Dupes and issues we already know about earn nothing. One payout per root cause, no matter how many endpoints.
Prove it, then stop. Access only your own accounts and data. If a test would surface someone else's data, stop at first proof and report — no pivot, no download, no persistence.
Do not degrade the service. Zero load testing, zero high-volume automated fuzzing, zero tests on proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
Give us time. Publish only after the fix lands and 30 days pass. We ping you when the fix is live.
Severity is ours to set. We rate the impact on our own systems, Bugcrowd Vulnerability Rating Taxonomy as the guide. Payouts go out by PayPal or USDT, in amounts we choose at our discretion within the ranges above.

Safe harbour. Research that follows these rules is authorised. Good-faith testing within scope means no legal action from us, and we ask you to match that good faith: no extortion, no threats of disclosure, no “pay first, details later”.

How to report

Email support@proxyjolt.com with the subject Security report. Give us the URL affected, the exact repro steps, which account you used and a proof of concept. We reply within 5 business days and rule on severity within 10 business days.

Machine-readable contact details are at /.well-known/security.txt.

Send a report

Policy last updated 2026-10-17.