Bug Bounty Policy

Company NoOnes (also referred to as “NoOnes,” “we,” “us,” or “our”) takes steps to improve our product and provide secure solutions for our customers. In this Bug Bounty Policy (“Policy”), we describe applicable cases for our Bug Bounty Program and how it should be used in connection with your use of our website at https://noones.com/, including, but not limited to, the NoOnes Wallet, online Bitcoin trading platform, mobile application, social media pages, or other online properties (collectively, the “Website”), or when you use any of the products, services, content, features, technologies, or functions we offer (collectively, the “Services”). This Policy is designed to help you obtain information about how you can participate in our Bug Bounty Program, which secure research results are applicable, and which benefits you can receive. Please note that our Service offerings may vary by region.

For all purposes, the English language version of this bug bounty policy shall be the original, governing instrument. In the event of any conflict between the English language version of this bug bounty policy and any subsequent translation into any other language, the English language version shall govern and control.

What is the Bug Bounty Program?

In order to improve NoOnes and the Services, the NoOnes Bug Bounty Program provides our users an opportunity to earn a reward for identifying security related issues.

How can you communicate your Bug Bounty Program findings to us?

All such communications should be directed to [email protected]. In your submission please specify full description of the vulnerability and verifiable proof that the vulnerability exists (explanation / steps to reproduce / screenshots / videos / scripts or such other materials).

Program Rules

Violation of any of these rules can result in ineligibility for a bounty.

• Test vulnerabilities only against an account that you own or accounts that you have consent from the account holder to test against.
• Never use a finding to compromise/exfiltrate data or pivot to other systems. Use a proof of concept only to demonstrate an issue.
• If sensitive information such as personal information, credentials, etc.. is accessed as part of a vulnerability, it must not be saved, stored, transferred, accessed, or otherwise processed after initial discovery.
• Researchers may not, and are not authorised to engage in any activity that would be disruptive, damaging or harmful to NoOnes.
• Researchers may not publicly disclose vulnerabilities (sharing any details whatsoever with anyone other than authorized NoOnes employees), or otherwise share vulnerabilities with a third party, without NoOnes's express permission.

How do we evaluate issues identified under the Bug Bounty Program?

All findings are evaluated using a risk-based approach.

Non-Disclosure Agreement

Before we begin discussing any details related to confirmed issues that you have identified under the Bug Bounty Program, including compensation, etc., you will be required to enter into a Non-Disclosure Agreement with us.

How do we pay Bug Bounty Program rewards?

All such rewards are paid by NoOnes. All rewards can be paid only if they are not contrary to applicable laws and regulations, including but not limited to trade sanctions and economic restrictions.

How long will it take us to analyze your Bug Bounty Program findings?

Due to the varying and complex nature of technical issues, we have not established particular timelines for analyzing findings under the Bug Bounty Program. Our analysis is finished only when we have confirmed the existence or absence of a vulnerability.

What cases are excluded from the Bug Bounty Program?

Certain vulnerabilities are considered out-of-scope for the Bug Bounty Program. Those out-of-scope vulnerabilities include, but are not limited to:

• Spam;
• Vulnerabilities that require social engineering/phishing;
• DDOS attacks;
• Hypothetical issues that do not have any practical impact;
• Security vulnerabilities in third-party applications and on third-party websites integrated with NoOnes;
• Scanner output or scanner-generated reports;
• Issues found through automated testing;
• Publicly-released bugs in Internet software within 30 days of their disclosure;
• Man-in-the-Middle attacks;
• Host header injections without a specific, demonstrable impact;
• Self-XSS, which includes any payload entered by the victim;
• Login/logout CSRF;
• Login/logout Clickjacking;
• Credentials found in leaked databases.

Vulnerabilities that enable attackers to authenticate, add, delete or modify any of the content on the blog.noones.com, noones.com/blog.