Sophos

Reporting

Verifiable evidence the vulnerability exists (screenshot/video/script) is required to receive recognition or an award for reported vulnerabilities.

For more technically elaborate vulnerabilities, reproduction steps are required. Rewards or recognition will not be awarded If our security team cannot reproduce and verify an issue. When researching a bug, please also use test accounts (and systems where appropriate) such that security and privacy of real users are not affected.

Reward Eligibility

As a researcher, you are only considered eligible for a reward if you're the first person reporting it to Sophos. We commit to having 48 business hours to respond to the report, and up to 90 days to implement a fix based on the severity of the report. Note that posting details or conversations about this report before it has been approved for disclosure or posting details that reflect poorly on this program or the Sophos brand will result in forfeiture of any award and/or immediate removal from the program.

DO NOT use the output from automated scanners and tools as your entire vulnerability report
DO provide a description of the nature and impact of the issue in your vulnerability report

Rewards

Qualifying bugs will be rewarded via Kudos based on severity, to be determined by Sophos security team. Rewards may range from Kudos to Sophos-branded swag. Awards are granted entirely at the discretion of Sophos.

Monetary Rewards

updated: May 30th, 2018
Monetary rewards are applicable to the following targets ONLY (please note the Out-of-Scope section for this program).
- *.cyberoam.com
- *.astaro.com
- *.reflexion.net

Priority	Amount
P1	$1,500 - $3,000
P2	Kudos
P3	Kudos
P4	Kudos

All other targets are rewarded with kudos ONLY. The priority of submissions will be assigned according to the Bugcrowd Vulnerability Rating Taxonomy.

At Sophos discretion, providing a complete research, proof-of-concept code, and detailed documentation may incur a bonus percentage on the bounty awarded. Conversely, Sophos reserves the right to less for vulnerabilities that require complex or over-complicated interactions or for which the impact or security risk is negligible, or misstated.

Credentials

For testing services and products that require credentials, please create an account on your own using your @bugcrowdninja.com email address. Your bugcrowdninja email address is your username @bugcrowdninja.com. All emails will go to the email address associated with your account.

If for some reason your IP address or account are banned during your research activity please contact us at bugbounty@sophos.com and we'll restore your access ASAP.

Special targets

dev.phishthreat.com

To obtain credentials for the dev.phishthreat.com target, please email phishthreatbounty@gmail.com with your Bugcrowd username.

Please note: This program does not allow disclosure. You may not release information about vulnerabilities found in this program to the public without explicit consent from Sophos.