Bug bounty
program

How it works

1. FindFind a security vulnerability in an in-scope place, using your own account.
2. ReportSend it as text from the Security reports page in your account: what it is, how to reproduce it and its impact.
3. Get rewardedWe review it and write to you if needed; if it is valid, we add your reward to your account or pay it, based on severity.

Scope

Vulnerabilities in the following are in scope:

• colitu.com, app.colitu.com and api.colitu.com
• docs.colitu.com (help centre)
• Windows, Android, Linux and iOS apps
• Browser extension
• VPN protocol configurations and leaks (leaking of IP, DNS or traffic information)

Out of scope

We do not accept reports about:

• Denial of service (DoS) and load tests
• Tests that disturb live servers or other users
• Social engineering
• Physical attacks
• Spam
• Third-party services (such as payment, e-mail and CDN providers)
• Scanner output without a demonstrated impact
• Missing security headers or best-practice suggestions with no impact
• Self-XSS
• Reports of only a missing rate limit
• Already known issues

Rules

• Test only with your own accounts; do not touch other users' accounts or data.
• Stop at proof of concept: do just enough to demonstrate the issue and go no further.
• Do not exfiltrate data (do not download, copy or keep it).
• Give us 90 days to fix it; do not publish details before that time is up or before we agree.
• The first valid report wins; later reports of the same issue count as duplicates.
• Describe a single issue per report.

Safe harbour

We treat research you carry out in good faith and within these rules as authorised. COLITU LIMITED will not take legal action against you for research that stays within these rules. Actions outside the rules are not covered by this commitment. Responsible disclosure policy →

Rewards

We decide the severity; the one you give is only a suggestion. Pro rewards are added to your account. For critical issues we decide the amount based on impact and tell you in the report conversation; we do not promise a fixed figure in advance.

• Low1 month of Pro

  Limited impact, hard to exploit or requires user interaction.

  • Disclosure of non-sensitive information.
  • A minor logic flaw that needs user interaction.
• Medium3 months of Pro

  Affects one user's data or actions in a limited way.

  • Stored XSS on an account page (visible to another user).
  • Seeing another user's limited data.
• High12 months of Pro

  Gives access to other accounts' data, VPN credentials or plan entitlements.

  • Access to another user's account or VPN credentials.
  • Getting a free Pro by bypassing payment or plan checks.
• CriticalCash reward

  Can be exploited remotely and affects the whole system or all users.

  • Unauthenticated remote code execution.
  • Access to all user data, or a leak that breaks our no-logging promise.

Hall of Fame

For accepted reports, if you ask for it, the name you chose is published here.

No entries yet.