DoubleProx logo
Log inStart now
Log inRegister
Security

Responsible disclosure & bug bounty policy

Any vulnerability you find in DoubleProx is something we want to hear about. To avoid surprises on either side, this page covers what is in scope, what earns payment, what does not, and how to report.

Scope

In scope

  • This website, doubleprox.com
  • The customer dashboard where you sign in, and its API
  • The dashboard's rotation links and API keys, and how it handles proxy credentials

Out of scope

  • Each proxy gateway and modem host, and the mobile carrier networks behind them
  • Third-party platforms: payment processors, Telegram, Cloudflare and email providers
  • Marketing assets served from legacy CDN paths
  • Customer accounts or data you do not own

What we pay

A reward requires demonstrated impact on our systems or our customers. Amounts are in USD.

Critical
$100 – $250
  • Remote code execution on our servers
  • SQL injection reaching customer data for reads or writes
  • Any account accessed without its credentials via an authentication bypass
  • Payment or balance tampering that yields proxies, credit or refunds without payment
  • Mass exposure of proxy credentials or personal data belonging to other customers
High
$50 – $100
  • Changing or reading another customer's account details, orders or proxies (IDOR)
  • Stored cross-site scripting executing within another customer's or an admin's session
  • Reaching admin functions from a customer account via privilege escalation
  • Server-side request forgery reaching internal services
  • Stealing the rotation link, API key or session of a different account
Medium
$20 – $50
  • Forged cross-site requests that change account state
  • Reflected cross-site scripting dependent on the victim clicking a link
  • Rate-limit bypasses with a demonstrated account takeover as the result
  • Pricing or business-logic flaws where a financial impact is demonstrated
Low / Informational
$0

Acknowledged, fixed when it is warranted, and not paid. The full list follows, so you can check it before writing the report.

Rules of engagement

  1. First valid report wins. Duplicates go unpaid, as do reports of issues we were already aware of. One root cause means one payment, regardless of how many endpoints it hits.
  2. Prove it, then stop. Access only your own accounts and data. If testing would expose another person's data, report after the first proof and stop there — no pivot, no download, no persistence.
  3. Do not degrade the service. No load tests, no high-volume automated fuzzing, and no testing of proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
  4. Give us time. Keep it unpublished until we fix the issue and 30 days pass. Once a fix is live, we let you know.
  5. Severity is ours to set. We judge impact on our own systems, referencing the Bugcrowd Vulnerability Rating Taxonomy. Amounts are at our discretion inside the ranges above, with payment by PayPal or USDT.
Safe harbour. Research that follows these rules is authorised. We won't pursue legal action against you over good-faith, in-scope testing, and we ask for equal good faith back: no extortion, no disclosure threats, no “pay first, details later”.

What we do not pay for

We accept these as Low or Informational at the most. They get read, and what is worth fixing gets fixed, but there is no bounty, and a Critical or High label on the report won't change that.

  • Session tokens that remain valid through a password reset, password change or logout until they expire
  • Missing or “weak” CSP, HSTS, X-Frame-Options or Referrer-Policy headers without a working exploit
  • Clickjacking against pages without any sensitive action
  • Non-session cookies and their cookie attributes
  • Email or username enumeration, also via timing differences or error messages
  • Forgot-password, login or rate-limit observations that do not demonstrate an account takeover
  • Opinions about our password policy: length, complexity, common-password lists, no forced rotation
  • Two-factor authentication not enforced, or 2FA missing entirely
  • Self-XSS or XSS that the attacker can trigger only within their own session
  • CSRF that targets login, logout, language or any other non-sensitive form
  • Open redirects that leak neither a token nor a credential
  • Software version, server banner, stack trace or path leaks that contain no sensitive data
  • SPF, DKIM or DMARC configuration reports
  • Automated scan results without a proof of concept
  • Resource exhaustion, brute force, denial of service or any test generating load
  • Social engineering or phishing that targets our staff or customers; any physical attack
  • Third-party issues in the services we use: Telegram, Cloudflare, payment processors, email providers
  • Out-of-date library versions without an exploit that works on our deployment
  • Exploits requiring a man-in-the-middle position, a compromised device or a rooted phone
  • Recommendations on best practice, theoretical risks, and known-issue duplicates

How to report

Email support@doubleprox.com with the subject Security report. List the affected URL, the exact reproduction steps, the account used, and a proof of concept. Acknowledgment comes within 5 business days, and a severity decision within 10 business days.

Machine-readable contact details are at /.well-known/security.txt.

Send a report

Policy last updated 2026-10-17.