Security

Responsible disclosure & bug bounty policy

If you spot a vulnerability in ProxySocial, we'd love to hear about it. Below we lay out what is in scope, what we pay for, what we do not pay for, and how to report, so there are no surprises for either of us.

Scope

In scope

This website, proxysocial.net
Your signed-in customer dashboard and the API behind it
Rotation links, API keys and the way proxy credentials are handled in the dashboard

Out of scope

Proxy gateways and modem hosts, along with the mobile carrier networks behind them
Services from third parties, namely payment processors, Telegram, Cloudflare and email providers
Marketing assets served from legacy CDN paths
Accounts and data of other customers, not your own

What we pay

Rewards go to demonstrated impact on our systems or our customers. Amounts are in USD.

Critical

$100 – $250

Remote code execution on our servers
Reading or writing customer data through SQL injection
Signing in to any account with no credentials via an authentication bypass
Tampering with payments or balances to obtain proxies, credit or refunds without paying
Bulk leaks of other customers' personal data or proxy credentials

High

$50 – $100

Reading or modifying the proxies, orders or account details of another customer (IDOR)
Stored XSS that fires in another customer's session or an admin's session
Privilege escalation that takes a customer account to admin functions
Server-side request forgery reaching internal services
Theft of a session, rotation link or API key belonging to another account

Medium

$20 – $50

A cross-site request forgery hitting an action that alters account state
Reflected XSS where the victim has to click a link
Getting around rate limits to achieve a demonstrated account takeover
Errors in pricing or business logic with a demonstrated financial impact

Low / Informational

We'll acknowledge and fix where warranted, but no payment. See the complete list below and check it before you write up the report.

Rules of engagement

First valid report wins. No payment goes to duplicates or to issues we already know about. We pay once per root cause, however many endpoints are affected.
Prove it, then stop. Access only your own accounts and data. Stop at the first proof and report if a test would expose someone else's data; do not pivot, download or persist.
Do not degrade the service. Load testing, automated fuzzing at volume and tests against proxy gateways, modem hosts or carrier networks are all off limits. Those are out of scope entirely.
Give us time. Publishing has to wait until the fix is in and 30 days have passed. When a fix is live, we will tell you.
Severity is ours to set. Our reference is the Bugcrowd Vulnerability Rating Taxonomy, and we rate impact on our own systems. How much we pay is at our discretion within the ranges above, and we pay by PayPal or USDT.

Safe harbour. Research that follows these rules is authorised. For good-faith testing within scope, we will not pursue legal action against you; we ask that you treat us with the same good faith, which means no extortion, no threats of disclosure, no “pay first, details later”.

What we do not pay for

The highest rating these can get is Low or Informational. We will go through them and fix what deserves fixing, yet no bounty is paid, and marking the report Critical or High makes no difference.

Staying signed in after you log out, change or reset your password, until the session token runs out
“Weak” or missing security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) not paired with a working exploit
Clickjacking where the page has no sensitive action to hijack
The attributes of cookies that aren't session cookies
Finding out which emails or usernames exist, including via timing or error messages
Notes on rate limits, login or forgot-password flows without a demonstrated account takeover
Password-policy preferences: length, complexity, common-password lists, lack of forced rotation
Accounts without two-factor authentication, or with 2FA as an option only
Self-XSS, or any XSS that the attacker alone can trigger in their own session
Login, logout, language and other non-sensitive forms hit by CSRF
An open redirect that does not leak any token or credential
Revealing a stack trace, path, server banner or software version that holds no sensitive data
SPF, DKIM or DMARC configuration reports
Scanner output from automated tools, lacking a proof of concept
Denial-of-service, resource exhaustion, brute-force attempts or any other test that generates load
Physical attacks, and phishing or social engineering of our staff or customers
Issues within the outside services we use: payment processors, Telegram, Cloudflare, email providers
Library versions that are outdated but lack a working exploit against our deployment
Attacks that depend on a man-in-the-middle position, a rooted phone or a compromised device
Duplicates of known issues, theoretical risks and best-practice recommendations

How to report

Email support@proxysocial.net with the subject Security report. Add the affected URL, exact steps to reproduce it, the account you tested with, and a proof of concept. We reply within 5 business days to acknowledge, and decide severity within 10 business days.

Machine-readable contact details are at /.well-known/security.txt.

Send a report

Policy last updated 2026-10-17.