Passquare Bug Bounty

We invite security researchers to participate in the Passquare Bug Bounty Program. We appreciate the contribution of researchers and reward valid vulnerabilities that improve the security of our ecosystem.

How to Join

To participate in the program, send an email to with the following information:

• Your first name, last name, and contact phone number;
• The IP address from which testing will be performed, or a request to authorize the X-Bug-Bounty header;
• A profile on any specialized platform (if available), such as hackerone.com, bugcrowd.com, intigriti.com, and others.

Allowed Vulnerability Types

Critical

• RCE
• SQLi / NoSQLi
• SSRF with access to internal resources
• Full authentication bypass
• Privilege escalation

High

• XXE
• Stored XSS
• Broken Access Control
• Insecure file upload
• MITM
• Session management issues

Medium

• Reflected XSS
• IDOR
• Business logic vulnerabilities
• Misconfigurations with medium impact
• Subdomain takeover
• Open redirect

Low

• Informational disclosures without impact
• Cache-related issues
• Minor configuration issues

No Reward

• Self-XSS
• Vulnerabilities requiring user interaction
• Attacks on pages fully controlled by the researcher
• Phishing and social engineering
• Impractical or non-scalable scenarios without real impact
• Missing DNS CAA / SPF / DKIM / DMARC records
• Missing security headers without exploitable impact
• Best-practice recommendations without a valid POC
• Low-impact server or domain configuration issues
• Reports based solely on automated scanners without a confirmed exploit

DoS/DDoS attacks are strictly prohibited.

If you want to test a vulnerability type not listed above, please request prior approval.

Testing Scope

Allowed domains:

• *.passquare.com

If a vulnerability is found outside the listed scope, prior approval is required.

Reporting Requirements

Reports should be sent to and must include:

• A detailed reproduction scenario;
• The script or tool used for exploitation;
• The execution log file;
• A screen recording demonstrating the exploitation.

After testing, the system must be returned to its original state.

Participation Rules

• Current and former Passquare employees are not eligible to participate.
• Public disclosure of vulnerabilities is prohibited, including after they have been resolved.
• Reports containing aggressive or non-constructive communication may be rejected regardless of their technical content.
• Rewards are not guaranteed if program rules are violated.