Security
Responsible disclosure & bug bounty policy
Report any vulnerability you find in Mobile Proxies US. This page defines scope, what is paid, what is not paid and how to report, so neither side is surprised.
Scope
In scope
- This website,
mobileproxiesus.com - Customer dashboard (signed-in area) and its API
- Dashboard: rotation links, API keys, proxy credential handling
Out of scope
- Proxy gateways; modem hosts; upstream mobile carrier networks
- Third-party services (payment processors, Telegram, Cloudflare, email providers)
- Marketing assets served from legacy CDN paths
- Any customer account or data you do not own
What we pay
Rewards require demonstrated impact on our systems or customers. Amounts are in USD.
Critical
$100 – $250
- Remote code execution on our servers
- SQL injection: read or write of customer data
- Authentication bypass: access to any account without its credentials
- Payment or balance manipulation: proxies, credit or refunds obtained without paying
- Bulk leak of other customers' proxy credentials or personal data
High
$50 – $100
- IDOR: read or write access to another customer's proxies, orders or account details
- Stored XSS executing in another customer's or an admin's session
- Privilege escalation: customer account to admin functions
- Server-side request forgery reaching internal services
- Theft: another account's API key, rotation link or session
Medium
$20 – $50
- CSRF on a state-changing account action
- Reflected XSS requiring a victim link click
- Rate-limit bypass resulting in demonstrated account takeover
- Pricing or business-logic flaws with demonstrated financial impact
Low / Informational
$0
Acknowledged. Fixed where warranted. Not paid. Full list below; check it before writing the report.
What we do not pay for
Maximum severity accepted: Low or Informational. Read and fixed where worth fixing. No bounty issued; a Critical or High label on the report does not change that.
- Session persistence after password reset, password change or logout, until session token expiry
- Absent or “weak” security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy), no working exploit
- Clickjacking on pages without sensitive actions
- Cookie attributes on non-session cookies
- Email/username enumeration, including via timing or error messages
- Forgot-password, login or rate-limit findings with no demonstrated account takeover
- Password policy preferences: length, complexity, common-password lists, lack of forced rotation
- Two-factor authentication absent, or 2FA optional
- Self-XSS; XSS triggerable only by the attacker in their own session
- CSRF: login, logout, language and other non-sensitive forms
- Open redirects exposing no token or credential
- Software version, server banner, stack trace or path disclosure; no sensitive data exposed
- SPF, DKIM or DMARC configuration reports
- Automated scanner output, no proof of concept
- Denial of service; resource exhaustion; brute force; any load-generating test
- Physical attacks; social engineering or phishing of staff or customers
- Third-party issues: payment processors, Telegram, Cloudflare, email providers
- Outdated libraries, no working exploit against our deployment
- Attacks requiring a rooted phone, compromised device or man-in-the-middle position
- Best-practice suggestions; theoretical risks; duplicates of known issues
Rules of engagement
- First valid report wins. Duplicates and reports of known issues: not paid. Per root cause: one payment, regardless of affected endpoint count.
- Prove it, then stop. Access only your own accounts and data. Test would expose another party's data: stop at first proof, report. No pivoting, downloading or persistence.
- Do not degrade the service. Prohibited: load testing, automated fuzzing at volume, tests against proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
- Give us time. No publication until the issue is fixed and 30 days have passed. You are notified when a fix is live.
- Severity is ours to set. Impact rating: on our own systems, referenced to the Bugcrowd Vulnerability Rating Taxonomy. Amounts: our discretion, within the ranges above. Payment method: PayPal or USDT.
Safe harbour. Research that follows these rules is authorised. No legal action for good-faith testing within scope. We ask the same good faith in return: no extortion, no threats of disclosure, no “pay first, details later”.
How to report
Email [email protected] with the subject Security report. Required: affected URL, exact reproduction steps, account used, proof of concept. Acknowledgement: within 5 business days. Severity decision: within 10 business days.
Machine-readable contact details are at /.well-known/security.txt.
Send a reportPolicy last updated 2026-11-08.