SECURITY · BUG BOUNTY

Find a hole in PFR. Get paid, get credited.

We hold traders’ purchase claims and payout proofs. If you can reach data you should not, we want to know before anyone else does.

Safe harbour for good-faith research inside the scope below.

41 reports resolved · $18,200 paid · median first response 6 h

Rewards by severity

Severity	Examples	Reward	Paid so far
Critical	Account takeover, access to another trader’s purchase proofs, remote code executionAccount takeover, access to another user’s purchase proofs, RCE	$2,500 – $5,000	2
High	Stored XSS on a firm page, IDOR on claims, auth bypass on the API	$800 – $2,500	9
Medium	CSRF on settings, rate-limit bypass on reviews, open redirect	$200 – $800	18
Low	Information disclosure without impact, missing headers	$50 – $200	12

Critical$2,500 – $5,000

Account takeover, access to another trader’s purchase proofs, remote code executionAccount takeover, access to another user’s purchase proofs, RCE

High$800 – $2,500

Stored XSS on a firm page, IDOR on claims, auth bypass on the API

Medium$200 – $800

CSRF on settings, rate-limit bypass on reviews, open redirect

Low$50 – $200

Information disclosure without impact, missing headers

In scope: propfirmsranking.com, the app subdomains and the public API.In scope: propfirmsranking.com, app subdomains and the public API.
Out of scope: firm websites, third-party payment processors, denial of service, social engineering of staff.
Test only with accounts you own. Never open another trader’s data even if you can: report the path instead.Test only with accounts you own. Never access another trader’s data even if you can; report the path instead.

Report

Email security@propfirmsranking.com. Include the steps and the impact.Email security@propfirmsranking.com. Include the steps and the impact.

Triage · 6 hoursTriage · 6 h

Severity assigned and a ticket id sent back to you.Severity assigned; you get a ticket id.

Fix

Critical within 48 hours, others within 14 days.Critical within 48 h, others within 14 days.

Pay and credit

Paid when the fix ships. Credited unless you prefer to stay anonymous.Paid on fix; hall of fame unless you prefer anonymity.

Is safe harbour guaranteed?

Yes, for good-faith research inside the scope above. We will not pursue legal action and will help if a third party does.

Do you pay for duplicates?

The first complete report of an issue is paid. Duplicates get credit in the hall of fame.