Caudalie Bug Bounty Program

In scope

https://en.caudalie.com

The program covers technical vulnerabilities in this web service only.

This is a live production website with real customers. Strictly forbidden:

Any denial of service (DoS/DDoS), load testing or request flooding
Creating, modifying or deleting any customer data (accounts, orders, addresses, loyalty points, payment methods…) other than your own
Placing fraudulent orders or abusing promotions, gift cards or vouchers

Use your own accounts, email addresses, phone numbers, etc. Do not try to access other people's accounts or any confidential information.

Rules of engagement

Your participation may be revoked if we detect any of the following:

Physical tampering with our data centers or offices
Social engineering (including phishing) targeting Caudalie employees, partners or customers
Breaking into Caudalie's infrastructure and using the information obtained to report vulnerabilities
Accessing arbitrary users' accounts or data, or any post-exploitation beyond what is needed to prove the vulnerability exists
Distributed flooding, denial of service or other resource-exhaustion attacks
Unsafe testing without prior authorization, including (but not limited to): testing out-of-scope assets, exploiting a vulnerability beyond what is needed to show impact (e.g. accessing internal information, dumping a database), using accounts or production credentials not approved by this policy, altering customer or production data, or otherwise affecting the stability of our systems

Automated tools: limit all tools and threads combined to 5 requests per second (300 per minute) per target host, with no more than 5 parallel requests.

Reactive protection

Conduct your research responsibly and keep the impact on users, moderators and administrators to a minimum.

Aggressive scans and tests may trigger alerts and automatic countermeasures: your account, phone number or IP address may be blocked. Moderation and monitoring processes are not suspended for the bug bounty, and the security team does not intervene in individual moderation or abuse decisions.

Submitting a report

A report must include a detailed description of the vulnerability and clear steps to reproduce it, or a working proof of concept. Videos and screenshots can illustrate a report but cannot replace a written description.

Reports without enough detail take much longer to triage. It also helps a lot if you explain how you found the vulnerability.

How reports are reviewed

Reports are reviewed by our security analysts. We assess each vulnerability based on its worst-case realistic exploitation.

We review reports within 7 days at most — usually sooner.

What we care about most

Mass access to customer data

Qualifying vulnerabilities

Remote code execution (RCE)
Local file access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
Code injection (JS, SQL, PHP, …)
Cross-site scripting (XSS) with real security impact
Broken authentication and session management
Insecure direct object references (IDOR)
CORS misconfiguration with real security impact
Horizontal and vertical privilege escalation
Any vulnerability giving access to other customers' data or to restricted features

Out of scope

The following issues are out of scope (ineligible or false positives):

Attacks requiring physical access to a user's device or clipboard
Password and account recovery policies (reset link expiry, password complexity, …)
Missing security headers that do not directly lead to a vulnerability (including CSP and X-Frame-Options)
Missing cookie flags on non-sensitive cookies
Use of a known-vulnerable library without proof of exploitability
Descriptive or unique error pages without proof of exploitability
Issues in software or protocols not under our control
Host header injection, unless you show it leads to theft of user data
Reports generated by automated tools or scanners
Vulnerabilities affecting only outdated or unpatched browsers and platforms
Social engineering, including phishing
Spam (e.g. sending emails without rate limits)
autocomplete attribute on web forms
Catalog data exposed by API endpoints
Race conditions
Loqate API key

Code of conduct

Do not violate others' privacy, disrupt our systems, leak or destroy data, or degrade the user experience.
Report vulnerabilities promptly (within days, not weeks). Do not take advantage of them.
Do not disclose any vulnerability publicly or to a third party until we have authorized it in writing.
Do not exploit any vulnerability fraudulently, in any form, against Caudalie, our partners or our users.