Security

Bug bounty program

We want to hear about security issues in Beyond before anyone else finds them. This page tells you what you can test, how to test it, and how to send us a report we will read.

We read every report that follows this page. We do not answer reports that skip it. Most of the mail we get is scanner output and copy-pasted templates, and the rules below are how we make time for the real reports.

tl;dr: test only the hosts in scope, use your own accounts, send one finding per email with a working proof of concept, and start the subject with the report code from the How to report section.

Scope

These hosts are in scope:

Everything else is out of scope. This includes:

• www.beyondpricing.com, blog.beyondpricing.com, go.beyondpricing.com, and other marketing sites
• support.beyondpricing.com, help.beyondpricing.com, and other sites that third parties host for us
• Customer booking sites on *.signal.beyondpricing.com and the WordPress sites of our customers
• Staging hosts, VPN endpoints, and internal tools
• This engineering blog
• Third-party services we use, such as payment processors, analytics, and property management systems. Report issues in those to the vendor.

If you find a host that is not on this list and you think it should be, ask us before you test it.

Rules of engagement

• Use only accounts that you create or own. Do not access, change, or delete data that belongs to other users. If you get access to someone else’s data by accident, stop, do not keep a copy, and tell us in your report.
• Send the header X-Bug-Bounty: <your handle> on every request you make. We use it to tell your traffic apart from an attack.
• Keep automated traffic under 5 requests per second per host.
• Do not run denial of service or load tests.
• Do not use social engineering, phishing, or physical attacks against our staff, customers, or offices.
• Do not send spam, and do not create more than 3 test accounts.
• Do not publish or share a finding before we fix it. See Disclosure.
• Delete any data you got from us when we close your report.

What we do not accept

We close these reports with no reply, unless you show a real attack with real impact on one of the hosts in scope:

• Output from automated scanners, with no manual proof that the issue is real
• Missing or weak SPF, DKIM, or DMARC records
• Missing HTTP security headers, such as CSP, HSTS, X-Frame-Options, or X-Content-Type-Options
• Clickjacking on pages with no sensitive action
• Software version numbers in banners, headers, or error pages
• Self-XSS, and any attack that needs the victim to paste code into their own browser
• CSRF on login, logout, or forms with no sensitive action
• Missing rate limits on endpoints that are not related to login, password reset, or payment
• Reverse tabnabbing
• Username or email enumeration
• Weak password rules, or session behavior after logout or password change
• TLS configuration findings, such as cipher suites or protocol versions
• Content spoofing or text injection with no HTML or script injection
• Open redirects with no further impact
• Publicly known issues in third-party software for which no patch exists yet
• Issues that need a rooted, jailbroken, or already compromised device
• Leaked credentials, unless you show that they work on a host in scope. Do not use them to go further than that.

How to report

Send your report by email to:

Turn on JavaScript to see the address.

Start the subject line with the report code [BYD-LANTERN], then a short title. For example: [BYD-LANTERN] IDOR on listing settings in api.beyondpricing.com. Our mail filter does not show us messages without the code.

Send one finding per email, in plain text, in English. Use this template:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Title:
Host and URL:
Vulnerability type:
Your severity estimate and why:

Steps to reproduce:
1.
2.
3.

Proof of concept:
(requests and responses, or a script we can run)

Impact:
(what an attacker can do to a real user or to Beyond, and what they need first)

Your test accounts:
Your X-Bug-Bounty handle:

A video alone is not a proof of concept. Send the requests and responses as text so that we can repeat them.

You can use any tool to find issues and to write your report, AI tools included. You must reproduce every finding yourself before you send it, and you must be able to answer our questions about it. We close reports that read like unchecked AI or scanner output. After two such reports from the same sender, we stop reading mail from that sender.

What happens next

• We reply within 5 business days to reports that follow this page.
• We tell you if we accept the finding within 10 business days of our first reply.
• We keep you updated while we fix it, and we tell you when the fix is live.
• If two people report the same issue, the first complete report counts.

Disclosure

Do not publish a finding until we confirm that it is fixed. We aim to fix accepted findings within 90 days. If you want to write about your finding after the fix, tell us first and we will agree on a date with you.

Rewards

We may pay a reward for a valid finding in scope with a real security impact. We decide the amount from the impact and the quality of the report. We do not pay for low-severity or informational findings, or for anything in What we do not accept. We pay after we fix the issue.

Do not ask about rewards before you send the full details of a finding. We do not reply to those messages.

You cannot get a reward if you are a current or former Beyond employee or contractor, if you broke the rules on this page, or if we cannot legally pay you, for example because of sanctions.

Safe harbor

If you follow this page in good faith, we consider your research authorized. We will not take legal action against you or ask law enforcement to act against you for it. If a third party takes legal action against you for research that follows this page, we will make it known that we authorized your work.

If you are not sure that something you want to do follows this page, ask us before you do it.