If you think you may have found a security vulnerability, please get in touch with us at security@wisepops.com.
Bug Bounty Program
Wisepops relies on the Bugcrowd Vulnerability Rating Taxonomy for the prioritization of findings. We currently pay rewards for P1, P2 & P3 vulnerabilities.
P1: $1,000 - $2,000
P2: $500 - $1,000
P3: $100 - $500
Do not send reports for P4 or P5 vulnerabilities, we don't reward them.
We strive to respond within 7 days.
We won't open attachments in the reports. Please provide any necessary information in plain text.
Targets in scope
id.wisepops.com
popups.wisepops.com
notifications.wisepops.com
wisepops.net
cdn.wisepops.net
cdn.wisepops.com
app.wisepops.com/api2 (API documentation & hooks documentation)
The behavior of Wisepops on the clients' websites.
You can use our sandbox to test it:
sandbox.wisepops.tech?hash=[YOUR HASH]
(your hash is in bold in the setup code we provide in Settings > Websites)
Out of scope
wisepops.com
support.wisepops.com
community.wisepops.com
Any domain not explicitly mentioned as target in scope
Access to our application
To test our application, please send a message to security@wisepops.com with the email address(es) for which you would like account(s) to be created.
Only test against accounts we have created for you.
Please do not perform
Distributed denial-of-service attacks
IP rotation to bypass our rate limits
Attacks against our existing user base
Social engineering, including phishing, and tricking our support team
Spam, flooding, or volume-based abuse of any of our tracking, event, or lead-ingestion endpoints (e.g. wisepops.net/_.gif)
Tests that deliberately risk the availability of our services
Known findings we don't reward
CSRF vulnerabilities
Stored XSS that impact the final visitors (through JS callbacks or other campaign's settings)
Verification link not expiring after being used
Lack of user session invalidation at email change / logout
No verification of the old email address ownership before changing it
Insecure Cipher Suite
Missing MTA-STS policy
Email hyperlink injection based on Email Provider
SSRF without internal impact
Denial-of-service vulnerabilities that do not have a major impact for a single payload
URLs indexed by web crawlers or archivers
Multiple owners due to race condition
Safe Harbor
Wisepops supports and encourages security research into our services. When conducting vulnerability research according to this policy, we consider this research to be:
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and Wisepops will not initiate or support legal action against you for accidental, good faith violations of this policy.
Exempt from the Digital Millennium Copyright Act (DMCA), and Wisepops will not bring a claim against you for circumvention of technology controls.
Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and Wisepops waives those restrictions on a limited basis for work done under this policy.
Lawful, helpful to the overall security of the Internet, and conducted in good faith.
You are expected, as always, to comply with all applicable laws.