Responsible Disclosure Policy

Purpose

We are dedicated to maintaining the security and privacy of the CaptchaFox service and customer data. We welcome security researchers from the community who want to help us improve our products and services.

If you discover a security vulnerability, please give us the chance to fix it by emailing us at security@captchafox.com. Publicly disclosing a security vulnerability without informing us first puts us and our customers at risk. When you notify us of a potential problem, we will work with you to make sure we understand the scope and cause of the issue.

Thank you for your work and interest in making the community safer and more secure!

Rewards

Scoria Labs GmbH may, at its sole discretion, reward security researchers for reporting valid, previously unknown vulnerabilities in in-scope services. Whether a report qualifies for a reward, and the amount of any reward, depends on the severity and impact of the issue and the quality of the report. There is no entitlement to a reward.

• Only the first report of a given vulnerability is eligible. Duplicates and issues already known to us or found internally are not eligible.

• Reports of out-of-scope issues or issues without demonstrable security impact are not eligible.

• Requesting payment before disclosing details, setting deadlines, or threatening public disclosure renders you ineligible and may be treated as extortion.

• We do not respond to inquiries asking whether we offer a bounty before a report is submitted. We may not respond to out-of-scope reports.

We reserve the right to change or discontinue rewards at any time. Additional documentation may be required based on residence of the researcher.

Report Requirements

To be considered, a report must include:

• The affected in-scope service and URL or endpoint

• Clear, step-by-step reproduction instructions

• A working proof of concept demonstrating real security impact

Raw output from automated scanners, theoretical issues, and "best practice" recommendations without a demonstrated exploit will be closed without a reward. Reports generated with AI tools that have not been verified by the reporter will be closed without a response. Reports can be submitted in English or German.

Rules

• NEVER attempt to gain access to another user's account or data.

• NEVER attempt to degrade the services.

• NEVER impact other users with your testing.

• Test only on in-scope domains, listed below.

• Do not send video proof of concepts.

• Do not use fuzzers, scanners, or other automated tools to find vulnerabilities.

• If you encounter personal or customer data, stop testing immediately, do not store or share it, and report it to us right away.

• Do not disclose the vulnerability publicly or to third parties without our written consent, and not before 90 days have passed since the issue was fixed.

Violating any of the above will render you ineligible for rewards.

Our Commitment

• We will acknowledge receipt of your report within 5 business days.

• We will keep you informed about the status of valid reports and let you know when the issue has been fixed.

• We will treat your report and personal details confidentially.

Safe Harbor

We will not take legal action against researchers who discover and report vulnerabilities in good faith and in compliance with this policy. This does not apply to activities that violate the rules above, involve out-of-scope services, or cause harm to CaptchaFox, our customers, or their users.

Eligibility

The following persons are not eligible for rewards:

• Current or former employees and contractors of Scoria Labs GmbH and their family members

• Residents of countries subject to EU or other applicable sanctions

• Minors without the consent of a legal guardian

In-Scope Services

Only the following services are in-scope:

• portal.captchafox.com

• api.captchafox.com

Please do not test or report issues with services not listed here, especially our marketing site captchafox.com.

Out-of-Scope Issues

The following types of reports/attacks are out of scope. Do not attempt them:

• Reports about any service not listed under "In-Scope Services", above

• Vulnerabilities in third-party services we use (e.g. payment, support or CDN providers). Please report these to the respective vendor.

• DOS attacks

• Brute force attacks

• Physical vulnerabilities

• Social engineering attacks, including but not limited to:

  • phishing

  • email auth (SPF, DKIM, DMARC, etc.)

  • hyperlink injection in emails

• Weak or legacy TLS/SSL versions and cipher suites, and other TLS configuration findings

• Missing or permissive security headers (e.g. CSP, HSTS, HSTS preload, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) without a demonstrated exploit

• Missing Secure, HttpOnly or SameSite flags on cookies that do not contain sensitive data

• Missing DNS or integrity hardening (e.g. CAA records, DNSSEC, Subresource Integrity)

• CORS misconfigurations without demonstrated data exposure

• CSRF on forms that are available to anonymous users (e.g., signup, login, contact, Intercom)

• Self-XSS and issues exploitable only through self-XSS

• Clickjacking and issues only exploitable through clickjacking

• Content spoofing and text injection without HTML/JavaScript execution

• Open redirects without additional security impact

• Reverse tabnabbing

• CSV or formula injection

• Host header injection without demonstrated impact

• Attacks requiring a man-in-the-middle position, a rooted or jailbroken device, an outdated browser, or a malicious browser extension

• Functional, UI and UX bugs and spelling mistakes

• Descriptive error messages (e.g. stack traces, application or server errors)

• HTTP 404 codes/pages or other HTTP error codes/pages

• Banner disclosure on common/public services

• Software version disclosure and reports of outdated libraries or components without a working proof of concept

• Vulnerabilities in third-party software published within the last 30 days

• Disclosure of known public files or directories, (e.g. robots.txt)

• Presence of application or web browser "autocomplete" or "save password" permission

• Absence of rate limits

• Credentials found in public data breaches that were not obtained from CaptchaFox systems

• EXIF on public images such as company logo

Acknowledgements

Researchers are listed here based on adherence to these program guidelines, professionalism, and significance or novelty of the issue(s) reported:

No one listed here yet.

Updates

We may periodically update the scope and guidelines of our program so please check back here periodically.