ExpressVPN
- $150 – $2,500 per vulnerability
- Up to $100,000 maximum reward
Announcing the Addition of Lightway Core to our Bug Bounty Scope!
We recently rolled out our Lightway protocol to all our users and open-sourced Lightway Core, the code which powers our new protocol. As part of our commitment to the security of the protocol, we are pleased to announce that Lightway Core will be added to the scope of our Bug Bounty program! This means that security bugs you find in Lightway Core will be eligible for a bounty.
We are interested in the following classes of security issues in our codebase:
- Buffer overflows, null pointer dereferences, heap overflows, use after frees, and other memory corruption bugs
- Remote code execution
- Arbitrary file read/write
- Exposing sensitive user data via logs or other means, violating our privacy policy
- Denial of Service
The following items are out of scope
- wolfSSL library: report any issues to wolfSSL directly
- Reference Implementation (lightway-laser)
- Information leaks in the Debug build
- Denial of service caused by out of memory errors in the client
Our codebase has been extensively audited by Cure53, and we are interested to see what the Crowd can find.
Happy hunting!
Walter