Twilio

Target Overview

Primary Targets

• Twilio Console
• Twilio Core Products
• Twilio API’s
• Twilio WebRTC Client
• Twilio SIP endpoints
• Twilio WebSockets (tsock.*.twilio.com)

Secondary Targets

• Twilio Developer Docs
• Twilio CDNs(static*.twilio.com)
• Twilio Blog
• Twilio Partner

Other Targets

Any host/ web property verified to be owned by Twilio (domains/IP space/etc.) but not listed in Primary or Secondary targets and not listed as Out of Scope.

NOTE: If a submission falls under Secondary or Other targets, and has a significant impact, bounty may be increased at Twilio’s discretion.

Rewards:

Category	Primary	Secondary	Other
P1	$3,000 - $8,000	$500 - $1,000	$100 - $200
P2	$1000 - $2,500	$200 - $500	Kudos -$100
P3	$200 - $400	$100 - $200	N/A
P4	$100 - $150	Kudos	N/A

Focus Areas

Core Twilio Products
Twilio Console
Twilio APIs
SIP
Video
Twilio WebRTC Client

Excluded Submission Types

• "Session too long," password reset/change logout or other intended business functionality
• Missing security headers (HSTS,X-XSS-Protection,X-Content-Type-Options, Content-Security-Policy , Cache-Control)
• All Wordpress-related findings
• Flash findings that require Flash to be enabled
• OpenVBX related findings
• Subdomain takeovers of TLD's used for demo or test purposes [such as companyfoo.com]
• Cookie valid after password change/reset
• Forgot password auto-login
• Social Engineering (for example, attempts to steal cookies, fake login pages to collect credentials)
• Denial of service attacks
• Resource Exhaustion attacks
• Missing Rate-Limiting issues
• Login or Forgot Password page brute force and account lockout not enforced
• Vulnerability reports related to the reported version numbers of web servers, services, or frameworks
• Non-existent or weak captcha / captcha bypass
• Vulnerabilities primarily caused by browser/plugin defects
• Weak password policies
• Email validation not enforced
• Internal IP address disclosure
• Missing DKIM/SPF
• Self XSS
• Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
• OPTIONS HTTP method enabled.
• SSL/TLS Issues such as:BEAST, BREACH, SSL insecure cipher suites enabled.
• Vulnerabilities that are limited to older/unsupported browsers
• Known vulnerabilities in libraries used by Twilio, usage of an outdated third party library (e.g. jQuery, Apache etc) unless you can prove exploitability.

Public Disclosure

Twilio does not permit public disclosure at this point in time.

Twilio Safe Harbor

We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy. We consider activities conducted consistent with this policy to constitute “authorized” conduct under the Computer Fraud and Abuse Act. To the extent your activities are inconsistent with certain restrictions in our Acceptable Use Policy, we waive those restrictions for the limited purpose of permitting security research under this policy. We will not bring a DMCA claim against you for circumventing the technological measures we have used to protect the applications in scope.
If legal action is initiated by a third party against you and you have complied with Twilio's bug bounty policy, Twilio will take steps to make it known that your actions were conducted in compliance with this policy.
Please submit a BugCrowd report to us before engaging in conduct that may be inconsistent with or unaddressed by this policy