Bug Bounty Program

Program Overview

GoComet is committed to maintaining the highest standards of security for our platform and users. We welcome the security research community to help us identify and responsibly disclose security vulnerabilities through our bug bounty program.

This program rewards security researchers who discover and report valid vulnerabilities in our systems. We value your efforts in making GoComet more secure and appreciate your responsible disclosure practices.

Severity Classification Model

GoComet follows the Common Vulnerability Scoring System (CVSS) v3.1 framework for assessing vulnerability severity. Each reported vulnerability will be evaluated based on CVSS metrics including:

• Attack Vector (Network, Adjacent, Local, Physical)

• Attack Complexity (Low, High)

• Privileges Required (None, Low, High)

• User Interaction (None, Required)

• Impact on Confidentiality, Integrity, and Availability

Important Note: While we use CVSS as our baseline assessment model, GoComet reserves the right to adjust the severity rating up or down to reflect the actual business impact and risk to our users, systems, and operations. Factors such as exposure scope, data sensitivity, exploitability in real-world scenarios, and potential business disruption will be considered in our final severity determination.

Severity Ratings

• Critical (9.0-10.0): Vulnerabilities with severe impact requiring immediate remediation

• High (7.0-8.9): Serious vulnerabilities with significant security implications

• Medium (4.0-6.9): Moderate vulnerabilities with limited scope or impact

• Low (0.1-3.9): Minor vulnerabilities with minimal security impact

• Informational: Security observations without direct exploitability

In-Scope Assets

The following assets are eligible for testing and vulnerability reporting:

• Domains - gocomet.com, app.gocomet.com, 

• Production APIs and web applications served from these domains

Out-of-Scope Assets

The following assets are NOT eligible for testing:

• Testing, QA, staging, development, or any non-production environments

• Third-party services or infrastructure not directly controlled by GoComet

• Physical security of GoComet offices or facilities

• Social engineering attacks against GoComet employees

Important: Testing out-of-scope assets may result in disqualification from the program.

In-Scope Vulnerabilities

The following vulnerability types and severity levels are eligible for rewards in the GoComet bug bounty program:

• Remote Code Execution (RCE): Unauthenticated or authenticated RCE on any production server or application

• Authentication Bypass: Complete circumvention of authentication mechanisms allowing unauthorized access to user accounts or admin panels

• Privilege Escalation: Ability to escalate from low-privilege user to admin or higher-privilege accounts

• SQL Injection: Injection flaws leading to unauthorized database access, data exfiltration, or manipulation

• Critical Business Logic Flaws: Vulnerabilities allowing complete bypass of critical security controls (e.g., payment processing, user verification)

• Large-Scale Data Breach: Vulnerabilities exposing massive volumes of sensitive user data (PII, financial information, authentication credentials)

• XXE (XML External Entity) Injection: Leading to RCE or large-scale data exfiltration

• Cross-Site Scripting (XSS): Authenticated or unauthenticated XSS allowing session hijacking, account takeover, or malware distribution

• Cross-Site Request Forgery (CSRF): Allowing state-changing operations (fund transfers, account modifications, admin actions) without user consent

• Insecure Direct Object Reference (IDOR): Unauthorized access to other users' sensitive data or resources

• Broken Access Control: Ability to access resources or perform actions beyond authorized privileges

• Sensitive Data Exposure: Unencrypted transmission of sensitive data (passwords, API keys, PII)

• Security Misconfiguration: Critical misconfigurations exposing sensitive information or functionality (e.g., exposed S3 buckets, default credentials)

• Insecure Deserialization: Leading to code execution or privilege escalation

• Path Traversal: Unauthorized file access outside intended directories

• API Authentication/Authorization Flaws: Bypassing API security controls

• Logic Vulnerabilities: Bypassing business logic controls with moderate security impact

Out-Of-Scope Vulnerabilities

The following vulnerability types, testing methods, and assets are NOT eligible for rewards:

These vulnerabilities will NOT receive rewards, regardless of discovery method:

• Denial of Service (DoS/DDoS) Attacks: All forms of DoS/DDoS testing, including volumetric attacks, application-level DoS, or resource exhaustion

• Self-XSS: Cross-site scripting vulnerabilities that require the victim to paste malicious code themselves or require significant social engineering to exploit. Self-XSS vulnerabilities that cannot be used to attack other users are not eligible

• Broken Links: Defunct or non-functional links on marketing, documentation, or blog pages

• Typos & Spelling Errors: Grammatical errors, misspellings, or minor text inconsistencies

• Email Configuration Issues: SPF/DKIM/DMARC misconfigurations (unless directly enabling email spoofing attacks)

• Outdated Software Library Mentions: References to outdated versions in documentation (without active vulnerability)

• Automated Vulnerability Scanner Reports: Generic scan results without proof of exploitability or manual validation

• Third-Party Security Issues: Vulnerabilities in third-party services or dependencies outside GoComet's control

• Unconfirmed Vulnerabilities: Theoretical vulnerabilities without proof of concept or demonstration of exploitability

• Feature Requests: Missing features, UI/UX improvements, or product suggestions

• Best Practice Recommendations: General security recommendations not representing actual vulnerabilities

• Duplicate Reports: Duplicate submissions of previously reported vulnerabilities

• Malware Distribution: Uploading or distributing malware, exploits, or harmful payloads

• Missing Security Headers (in isolation): When not combined with actual security exploitation vectors

Reporting Requirements

To ensure efficient triage and validation of your vulnerability report, please include the following information: