Security

Responsible disclosure & bug bounty policy

Should you find a vulnerability in EliteProx, we want to hear about it. So that neither side is surprised, this page sets out the scope, what we pay for, what we do not pay for and how to report.

Scope

In scope

This website, eliteprox.net
The API and the customer dashboard you sign in to
Rotation links, API keys and proxy credentials as handled within the dashboard

Out of scope

Proxy gateways, modem hosts, and the mobile carrier networks that sit behind them
External third-party services: payment processors, Telegram, Cloudflare, email providers
Marketing assets served from legacy CDN paths
Any customer data or account other than your own

What we pay

Only demonstrated impact on our systems or our customers is rewarded. Amounts are in USD.

Critical

$100 – $250

Remote code execution on our servers
SQL injection with read or write access to customer data
An authentication bypass that opens any account without its credentials
Manipulation of payments or balance — proxies, credit or refunds obtained without paying
Exposure, in bulk, of other customers' proxy credentials or personal data

High

$50 – $100

Reading or altering another customer's proxies, orders or account details (IDOR)
Stored cross-site scripting that runs in the session of an admin or of another customer
Privilege escalation giving a customer account access to admin functions
Server-side request forgery reaching internal services
Another account's API key, rotation link or session being stolen

Medium

$20 – $50

Cross-site request forgery on actions that modify account state
Cross-site scripting of the reflected kind that requires a link click by the victim
A demonstrated account takeover made possible by a rate-limit bypass
Errors of pricing or business logic carrying a demonstrated financial impact

Low / Informational

Each is acknowledged and fixed where warranted, though not paid. So you can check before writing the report, the full list appears below.

Rules of engagement

First valid report wins. Reports of known issues, and duplicates, receive no payment. Payment is made once per root cause, irrespective of endpoints affected.
Prove it, then stop. Access only your own accounts and data. Where a test would expose data belonging to someone else, stop at the first proof and report, without pivoting, downloading or persisting.
Do not degrade the service. Load testing is not permitted, nor is automated fuzzing at volume or testing against proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
Give us time. Nothing should be published until the issue is fixed and 30 days have elapsed. We will inform you when a fix is live.
Severity is ours to set. Impact is assessed on our own systems, with the Bugcrowd Vulnerability Rating Taxonomy serving as the reference. Payment amounts sit within the ranges above at our discretion and are paid by PayPal or USDT.

Safe harbour. Research that follows these rules is authorised. Testing done in good faith and within scope will not be met with legal action from us, and we ask that you offer us the same good faith: no extortion, no threats of disclosure, no “pay first, details later”.

What we do not pay for

These are capped at Low or Informational when accepted. We read these and fix the ones worth fixing; no bounty is issued, however, and a Critical or High label on the report does not alter that.

Any session left active after logout, a password change or a password reset, until the session token expires
Reports of missing or “weak” security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) with no working exploit
Clickjacking on any page that holds no sensitive action
Cookie attributes set on non-session cookies
Enumeration of usernames or email addresses, including by timing or error messages
Observations on forgot-password, login or rate-limit behavior lacking a demonstrated account takeover
Password policy views covering length, complexity, common-password lists and no forced rotation
Lack of two-factor authentication, or 2FA offered only as optional
Self-XSS, and XSS triggerable only by the attacker in their own session
CSRF limited to login, logout, language or other non-sensitive forms
Open redirects not leaking a credential or token
Disclosed software versions, server banners, stack traces or paths without sensitive data in them
SPF, DKIM or DMARC configuration reports
Output of automated scanners that has no proof of concept
Any load-generating test, including denial of service, resource exhaustion or brute force
Phishing or social engineering of our customers or staff, plus physical attacks
Vulnerabilities that live in our third-party providers: payment processors, Telegram, Cloudflare, email providers
Outdated versions of libraries, absent a working exploit against our deployment
Attacks possible only with a compromised device, a rooted phone or a man-in-the-middle position
Theoretical risks, recommendations on best practice and duplicate reports of known issues

How to report

Email support@eliteprox.net with the subject Security report. Please provide the affected URL, precise steps to reproduce, the account you used, and a proof of concept. Within 5 business days we acknowledge your report, and within 10 business days we give a severity decision.

Machine-readable contact details are at /.well-known/security.txt.

Send a report

Policy last updated 2026-10-17.