Bug Bounty Program

To enhance our platform and service security, we believe in investing into the security researcher community. As many online businesses, we therefore run a bug bounty – or otherwise known as – vulnerability reward program.

Click on this link to find it.

Services in Scope

The scope of our program is simple. Any tech property that belongs to our business is in scope. Anything that you can break into, we have to assume an attacker can break into.

To see our full scope, please visit our YesWeHack page. Link

Qualifying Vulnerabilities

It is 2024 and we assume you know the common vulnerability types that an online business may be affected by. As long as the issue constitutes a tangible risk to our security posture, customer data or similar, it is likely going to qualify. Please understand this is a discretionary decision we make on a case-by-case basis for every incoming report.

Reward Structure

Incoming vulnerability reports discussed and rated by our Security Board on a monthly basis. Our goal is to reward eligible reports in a reasonable way depending on the underlying risk potential.

Contact Us

You may report bugs by emailing security@alasco.de

If you’d like, you can encrypt using our GPG key.

Legal Aspects

We are unable to issue rewards to individuals who are on sanctions lists, or who are in countries (e.g., Cuba, Iran, North Korea, Syria, Crimea, and the so-called Donetsk People’s Republic and Luhansk People’s Republic) on sanctions lists.

Participants of our program are responsible for any tax implications that are applicable.

Please understand that the decision as to whether or not to pay a reward is made entirely at Alasco’s discretion.