infomaniak-bug-bounty-program
45
In Scope
15
Out of Scope
In-Scope Assets (45)
Out-of-Scope Assets (15)
| Asset | Category | Bounty | |
|---|---|---|---|
| Assets not listed in the in scope section are to be considered as out of the scope of this program and won't be eligible for reward | OTHER | Yes | |
| Database service instances from customers, like *.dbaas.infomaniak.cloud | OTHER | Yes | |
| FTP credentials from our customers, like *.ftp.infomaniak.com | OTHER | Yes | |
| Jelastic subdomains : *.jcloud.ik-server.com, *.jpc.infomaniak.com, *.jpe.infomaniak.com | OTHER | Yes | |
| MySQL credentials from our customers, like *.myd.infomaniak.com | OTHER | Yes | |
| S3 credentials from our customers, like s3.pub*.infomaniak.cloud | OTHER | Yes | |
| This domain https://drive.infomaniak.com/app/office/:folder:/:file: is out of scope. This is only office application, an external app to open MS office documents. | OTHER | Yes | |
| User email verification | OTHER | Yes | |
| VPS instances from our customers, like *.vps.infomaniak.com | OTHER | Yes | |
| We do not manage Open Stack dashboard which is therefore out of scope | OTHER | Yes | |
| Websocket IPS-public credentials (MQTT, info-mq, IPS_RABBIT, ips-public). Public identifiers that do not allow access to information outside the scope of the user's profile. | OTHER | Yes | |
| acronis.infomaniak.com | OTHER | Yes | |
| https://api.pub1.infomaniak.cloud | OTHER | Yes | |
| ov-XX.infomaniak.ch and od-XX.infomaniak.ch sub domains | OTHER | Yes | |
| partner program : pages about finding partner and sending offer / All routes ending with /partners/tender | OTHER | Yes |