Good News for Bug Hunters — OS.University Smart Contracts are Public!
Open Source University team believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you’ve found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly. Please send all security reports to security@os.university.Disclosure Policy
Let us know as soon as possible upon discovery of a potential security issue, and we’ll make every effort to quickly resolve the issue. Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Exclusions
While researching, we’d like to ask you to refrain from: Denial of service, spamming, social engineering (including phishing) of OS.University staff or contractors, any physical attempts against OS.University property or data centers.
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Eligibility
The following requirements must be adhered to in order to participate in OS.University bug bounty program, and for any report to qualify. Not following these requirements can result in anywhere from your report being rejected, up to a ban from the program, depending on the severity.
1. Report format
For any report to be considered, you must provide clear instructions on how to reproduce the issue, as well as how it could be exploited (attack scenario), and (to the best of your knowledge) what is the security impact. This information helps us assess eligibility and appropriate bounty amounts.
2. First come, first served
Only the first person to identify a particular vulnerability will qualify for a bounty. Any reports submitted after that will be considered as duplicates and will not qualify.
3. Play it safe
All testing must be performed on test acconts under your control. Any attacks against other users without provable express consent is not allowed and may result in a ban from our program. If a particular issue is severe enough that a PoC in itself may expose other users’ data, please ask us for help first so we can work together on how to safely demonstrate the bug.
4. Don’t disclose early
To best protect our users, please keep all identified vulnerability details between you and us until we’ve had a chance to fix the issue. Public disclosure prior to us notifying you of the fix may result in a ban from the program. If you have any questions on remediation timeline, please inquire directly on the relevant report.
5. No social engineering
Bugs that require social engineering to exploit (e.g. tricking someone into clicking a link) may qualify, but please do not actually attempt to social engineer another user, any OS.Universtiy team member, etc. during your testing. Providing a clear explanation of how social engineering could be used in conjunction with an identified vulnerability is sufficient.
OS.University Smart Contract:
https://github.com/OpenSourceUniversity/EDUToken
Submit BUG here:
If you have any further questions, feel free to contact us the Bounty thread on BitcoinTalk.
[UPDATE] Bounty Campaign has been updated
Interested in OS University? Follow us!
Facebook | Twitter | Telegram | Bitcointalk.org | Reddit