Aurasell Bug Bounty Program
This program is our way of rewarding security researchers for responsibly identifying and reporting serious security vulnerabilities in Aurasell’s in-scope systems.
Aurasell Bug Bounty Program
At Aurasell, security is a top priority. While we work hard to protect our platform and customers, we recognize that vulnerabilities can still occur. We encourage independent security researchers to help us improve the safety of our products and services.
If you believe you have discovered a security vulnerability in Aurasell, we want to hear from you. Please review this page carefully before submitting a report.
Our Commitment
Aurasell’s Security Team strives to:
- Acknowledge and triage all valid reports within 10 business days
- Transparently assess and communicate the security impact
- Issue bounty payments within 20 business days after remediation (excluding extenuating circumstances)
- Close reports as Not Applicable (N/A) only when:
- The issue is already known or previously reported
- The report lacks sufficient evidence
- The issue falls under Out-of-Scope Vulnerabilities
- The impact or risk is deemed very low
Bug Bounty Program Policy
To protect both Aurasell and security researchers, participation in this program requires compliance with the following rules:
- Allow Aurasell reasonable time to investigate and remediate reported vulnerabilities before any public disclosure.
- Do not violate user privacy or access, modify, destroy, or exfiltrate data.
- Do not disrupt, degrade, or deny service availability.
- Do not intentionally violate any applicable laws or regulations.
- Do not exploit vulnerabilities beyond what is necessary to demonstrate their existence.
- You are not authorized to access user data, personal data, or internal company data.
- All vulnerabilities must be reported to Aurasell as soon as they are validated.
- By submitting content to Aurasell, you waive any moral rights to the submission.
- All submitted content is licensed to Aurasell under the MIT License.
- Failure to follow these rules will result in disqualification from the program.
Legal Notice
Aurasell reserves the right to modify or cancel this program at any time. Participation does not guarantee a bounty payment, which remains at Aurasell’s sole discretion.
Testing must not violate any laws or compromise data that is not owned by the researcher. Eligibility for payment may depend on local laws and regulations.
Activities conducted in compliance with this program are considered authorized under applicable computer misuse laws. If a third party initiates legal action against a compliant researcher, Aurasell may publicly or legally confirm the researcher’s authorized participation.
Upon request, researchers agree to execute any additional documents necessary to carry out the intent of these terms.
Bug Bounty Guidelines
To remain eligible for rewards, researchers must follow these guidelines:
- Do not violate user privacy, destroy data, or disrupt services.
- Do not request status updates earlier than 10 business days after submission.
- Any threatening, extortive, or aggressive behavior results in immediate disqualification.
- Only test accounts you personally own and control.
- Do not exploit vulnerabilities for personal or third-party benefit.
- Do not target physical security, use social engineering, spam, or perform DDoS attacks.
- If a vulnerability provides system-level access, stop testing immediately and report it.
- Disclosure to any party other than Aurasell is strictly prohibited.
- Bug disclosure communications are confidential.
- All proof-of-concept artifacts (code, screenshots, videos) must be destroyed after the report is closed.
Bug Bounty Scope
In-Scope Systems
- Aurasell web applications
- Aurasell administrative consoles
- Aurasell APIs
- Other Aurasell-owned production services
In-Scope Vulnerabilities
Vulnerabilities eligible for reward typically include (but are not limited to):
- SQL Injection
- Remote Code Execution
- Directory Traversal
- Privilege Escalation
- Authentication and Authorization Bypass
- Sensitive Data Exposure
- Cross-Site Scripting (XSS)
- Local or Remote File Inclusion
- Cross-Site Request Forgery (CSRF)
- Server-Side Request Forgery (SSRF)
- Open redirects that lead to token or credential theft
- Security control bypasses
- Administrative interfaces without authentication
Eligibility and severity are determined solely by Aurasell.
Out-of-Scope Vulnerabilities
The following issues are not eligible for rewards:
- Open redirects without serious impact
- Clickjacking
- Cache poisoning
- Content spoofing
- Missing SPF, DKIM, or DMARC records
- Brute-force attacks
- Non-reproducible issues
- Missing rate limiting
- Denial-of-Service (DoS / DDoS) attacks
- CSRF with minimal or no impact
- Stack traces or path disclosures
- Vulnerabilities requiring Man-in-the-Middle (MITM) attacks
- Theoretical subdomain takeovers without evidence
- Self-inflicted vulnerabilities by merchants
- Missing HSTS
- Issues affecting outdated or unsupported browsers or operating systems
- Informational security headers or version banners
- Physical attacks, social engineering, phishing, spam, or DDoS-related issues
- Previously reported or known vulnerabilities
- Third-party hosted systems unless they directly impact Aurasell
Reporting a Vulnerability
To submit a report, email: security@aurasell.ai
Please include:
- A clear description of the vulnerability
- Steps to reproduce the issue
- Affected system or endpoint
- Date of discovery
- Any relevant proof-of-concept details
Reports must relate to vulnerabilities listed under In-Scope Vulnerabilities.
Payout Scale (USD)
Eligible vulnerabilities are rewarded based on severity, impact, and exploitability. All amounts are in USD.
Note: Final reward amounts are determined at Aurasell’s sole discretion and may vary based on complexity, business impact, and originality.
Go from human to superhuman operators in under two hours.
Start without risk, scale without limits.
