HistAI Bug Bounty Program

HistAI runs a Bug Bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of HistAI

The following websites are within the scope of the program:

• hist.ai

• celldx.hist.ai

The following section encompasses submission of the vulnerabilities that do not require intrusive testing:

• Cross Site Scripting (XSS)

• Open Redirect

• Cross Site Request Forgery (CSRF)

• Improper Access Control

General Requirements:

Out-of-scope vulnerabilities:

• Reports from automated scanners without appropriate analysis or demonstration of security impacts

• Reports about outdated/vulnerable software without exploitation examples

• Self-XSS affecting only current user

• Missing CSRF token in forms, where sensitive information like user data cannot be modified (e.g. logout form)

• Issues related to window.opener

• Session hijacking, session timeout

• Missing security HTTP headers (X-Frame-*, X-Content-*, CSP, HSTS, HPKP)

• Missing SPF, DKIM, DMARC records

• Missing "HttpOnly", "secure", "SameSite" flags for non-sensitive cookies

• Possibilities for exhaustive search by user/item identifiers

Strictly prohibited:

• Searching for vulnerabilities in out-of-scope and 3rd-party services, including payment gateways

• DoS/DDoS/physical access/phishing/social engineering attacks

• Stealing regular users' accounts and performing any other actions affecting their security

• Publishing any sensitive information discovered during security testing

Possible Awards:

Depends on the scope of the issue discovered and upon our sole discretion.

We appreciate receiving reports on safety issues and related concerns to improve the security and reliability of our sites. Please send detailed information about these issues to security@hist.ai allowing us to replicate and address them effectively.