Vulnerability Disclosure / Bug Bounty Program

Last updated: June 6, 2025

Overview

Codesphere is committed to maintaining the security of our platform. We appreciate the efforts of external security specialists who help identify vulnerabilities. This page outlines our Security Vulnerability Reward Program (Bug Bounty), providing guidelines for reporting security issues and eligibility for rewards.

Reporting a Vulnerability

If you believe you have found a security vulnerability in Codesphere, please report it to us. To ensure efficient processing, please follow these steps:

  1. Report via Email: Send a detailed report to either support@codesphere.com or security@codesphere.com.

  2. Include Details: Please provide a clear description of the vulnerability, steps to reproduce it, and any potential impact. Include as much detail as possible to help us understand and verify the issue quickly.

  3. Example Format: You may use the following template as a guide:

Hi Codesphere Team,

I’m [Your Name/Organization], a security analyst, and I have found a potential security vulnerability in the Codesphere app.

Description of the issue: [Provide a description]

Steps to reproduce: [Provide detailed steps]

[Optional] Proof of Concept: [Include any proof of concept if available]

Regards,

[Your Name/Organization]

Eligibility and Rewards

  • Valid Vulnerabilities: Only previously unknown vulnerabilities within the codesphere.com domain are eligible for rewards.

  • Severity Rating: Upon receiving your report, we will internally assess the severity of the vulnerability.

  • Reward Structure: Rewards are determined based on the severity of the vulnerability

  • Known Vulnerabilities: Issues that are already known to us are not eligible for a bounty (see Out of Scope / Known).

Out of Scope / Known

The following types of vulnerabilities are either considered out of scope or known and will not be rewarded:

  • Self-XSS

  • User/workspace enumeration

  • Exposed metrics endpoint

Payment Process

If your report is validated you could be entitled to a reward from 100€ to 1000€. We will guide you through the payment process, which includes:

  1. Tax Forms: Providing the necessary tax forms (W8 for non-US persons, W9 for US persons, or W8-Ben-E for companies).

  2. Invoice: Submitting an invoice to invoice@codesphere.com with your payment details.

Important Notes

  • We aim to respond to and address reported issues promptly.

  • Please refrain from publicly disclosing any vulnerabilities until they have been resolved by our team.

  • We reserve the right to modify the terms of this program at any time.