<div class="flex flex-col space-y-4">
Even though our specialists do their best to lessen all the bugs in our systems, Pylon Eco Token (PETN) invites independent security groups and individual researchers to study it across all platforms and help us make it even safer for our customers. If you discover a bug, we appreciate your cooperation in responsibly investigating and reporting it to us, so that we can address it as soon as possible. For Security related bugs/vulnerabilities, we offer rewards and recognitions.
So, if you think that you have found a security vulnerability on this site, Please send us a report on our live sites listed in the whitepaper.
<h5>Vulnerability description and reporting:</h5>
Generally speaking, any bug that poses a significant vulnerability could be eligible for the reward. But it's entirely at our discretion to decide whether a bug is significant enough to be eligible for the reward.
Security issues that typically would be eligible (though not necessarily in all cases) include:
<ul class="list-disc pl-8">
<li>Cross-Site Request Forgery (CSRF)</li>
<li>Cross-Site Scripting (XSS)</li>
<li>Code Executions</li>
<li>SQL injections</li>
<li>Server-Side Request Forgery (SSRF)</li>
<li>Privilege Escalations</li>
<li>Authentication Bypasses</li>
<li>File inclusions (Local &amp; Remote)</li>
<li>Protection Mechanism bypasses (CSRF bypass, etc.)</li>
<li>Leakage of sensitive data</li>
<li>Directory Traversal</li>
<li>Payment manipulation</li>
<li>Administration portals without authentication mechanism</li>
</ul>
Things that are not eligible for reward include:
<ul class="list-disc pl-8">
<li>Lack of rate-limiting mechanisms</li>
<li>Captcha related concerns</li>
<li>Open redirects without a severe impact</li>
<li>Application stack traces (path disclosures, etc.)</li>
<li>Self-type Cross-Site Scripting / Self-XSS</li>
<li>Vulnerabilities that require Man in the Middle (MiTM) attacks</li>
<li>Denial of Service attacks</li>
<li>CSRF issues on actions with minimal impact</li>
<li>Cache Poisoning</li>
<li>Clickjacking</li>
<li>Missing SPF records</li>
<li>Brute force attacks</li>
<li>Security practices (banner revealing a software version, missing security headers, etc.)</li>
<li>Vulnerabilities on sites hosted by third parties unless they lead to a vulnerability on the main website.</li>
<li>Vulnerabilities are contingent on physical attack, social engineering, spamming, DDOS attack, etc.</li>
<li>Vulnerabilities affecting outdated or unpatched browsers / Operating Systems.</li>
<li>Bugs that have not been responsibly investigated and reported.</li>
<li>Bugs in products or websites related to acquisition for a period of 180 days following any public announcement.</li>
<li>Bugs are already known to us, or already reported by someone else (reward goes to the first reporter).</li>
<li>Issues that aren't reproducible.</li>
<li>Issues that we can't reasonably be expected to do anything about.</li>
<li>Before participating in our bug bounty program, please see below our rules and procedures:</li>
<li>Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.</li>
<li>Submit one vulnerability per the report, unless you need to chain vulnerabilities to provide impact.</li>
<li>When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).</li>
<li>Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.</li>
<li>Social engineering (e.g. phishing, vishing) is prohibited.</li>
<li>Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.</li>
</ul>
If any organization or individual decides to participate in our bug bounty program, they have to agree on the following:
<ul class="list-disc pl-8">
<li>A bug report should contain enough information and a proof of concept code or screenshot.</li>
<li>You agree to participate in testing the effectiveness of the countermeasure applied to your report.</li>
<li>You agree to keep any communication with Pylon Eco Token (PETN) in private.</li>
</ul>
How to report a bug
<ul class="list-disc pl-8">
<li>Please send an email to bug@pylonecosystem.com (in the subject line indicate &ldquo;Bug reporting&rdquo;).</li>
<li>Include as much information in your report as you can. Ideally, a description of your findings, the steps needed to reproduce it, and the vulnerable component (i.e. API endpoint, etc.)</li>
<li>If you need to share screenshots/videos, please upload them to your own Google Drive or any other upload service and share with us the links to those files in the form.</li>
<li>Include your correct name and email address so we can reach out to you.</li>
<li>Allow us up to 7 business days to respond before sending another email on the matter.</li>
<li>All the Rewards will be paid in PETN Tokens, So please send PETN wallet address too.</li>
</ul>
Wall of Fame
<ul class="list-disc pl-8">
<li><a href="https://twitter.com/itsZ4X" target="_blank" rel="noopener noreferrer">Zax Asif</a></li>
<li>Your name could be here</li>
</ul>
Note:
<ul class="list-disc pl-8">
<li>We will respond to qualified security researchers only.</li>
<li>Rewarding a security researcher is the sole decision of the security department of Pylon Eco Token (PETN), so it's not your right to get rewarded in every issue submission.</li>
<li>Same bug may be reported by multiple security researchers, we will reward only one person who is the first to report by explaining the issue in a simpler and better way.</li>
<li>We have a Wall of Fame for all security researchers (including rewarded and non rewarded who spend their valuable time to find and report the bug in our website).</li>
<li>To list your information in the Wall of Fame, please send your Display Name and any Social Media Profile or Email to link on it.</li>
</ul>
</div>
&nbsp;