Bug bounty program
Found one? Report it responsibly.
Flosa hosts companies' financial and HR data. If you find a security vulnerability, please report it responsibly; we take your report seriously. The reward table and amounts will be announced once the program is officially confirmed.
Responsible, coordinated disclosureReports by security emailNo reward promised before the program is confirmed
RewardTo be determinedReward amounts will be announced once the program is officially confirmed
—Paid to date
—Valid reports fixed
—Average review time
—Researchers in the Hall of Fame
Rewards
Severity is measured with CVSS v3.1 and the real impact on customer data. The amount for each row will be announced once the program is officially confirmed, and until then no reward is guaranteed.Based on severity, not on haggling.
CriticalCVSS 9.0–10.0After the program is announcedRemote code execution, cross-company data access, authentication bypass
HighCVSS 7.0–8.9After the program is announcedIDOR on financial/HR data, privilege escalation, SQLi
MediumCVSS 4.0–6.9After the program is announcedStored XSS, CSRF on sensitive operations, limited information disclosure
LowCVSS 0.1–3.9After the program is announcedReflected XSS, misconfiguration with low impact
InformationalCVSS —After the program is announcedBest practices with no direct security impact
Bonus multipliers may be considered for vulnerabilities that break the boundary between two companies (tenants) or for reports with a full PoC and a suggested fix; details will come with the program announcement.
Scope
What is in, and what is not.
In scope
app.flosaerp.comWeb panel
api.flosaerp.comAPI and webhooks
liana.flosaerp.comLiana AI
*.flosaerp.comProduct subdomains
Android / iOSLatest released Android and iOS versions
flosaerp.comWebsite and payments
Out of scope
Denial-of-service attacks (DoS/DDoS) and load testingSocial engineering, phishing of employees or customersPhysical access to offices or data centersOld app versions or unsupported browsersAutomated scanner reports without a PoCMissing security headers without demonstrable impact, clickjacking on pages with no sensitive actionUsername enumeration, password policy, not being signed out after a password changeThird-party services (payment gateway, SMS, tax system)
Rules and responsible disclosure
Research responsibly; we will respond responsibly.
If you follow the rules and act in good faith, we will review your report cooperatively. If you accidentally access data during your research, stop immediately and report it. The exact legal terms (including safe harbor) will be published with the official announcement of the program.
1Your own account onlyTest with your own trial account; never access, modify, or store real customer data.
2Minimum impactStop as soon as the vulnerability is proven. One record is enough as proof.
3No disruptionLoad testing, aggressive scanning, or anything that slows or interrupts the service for others is prohibited.
4Coordinated disclosureDo not publish details until we have fixed and confirmed the issue; the exact deadline will be announced in the program terms.
5First valid reportPriority goes to the first complete report of a given vulnerability; duplicate reports are notified.
6Good faithAct honestly and according to these rules, with the intent to report and without abuse.
7Who cannot participateCurrent and former Flosa employees and contractors who have had access to the source code; exact terms will be announced with the program.
Process
From report to fix, in five steps.
1StartSubmitSend the report by security email.
2After receiptInitial reviewThe security team reproduces the issue and gives an initial severity.
3By severityFixThe engineering team ships the patch; you are kept informed.
4After the fixConfirmationFinal severity is set using CVSS and real impact.
5After the fixDisclosureDetails are published by mutual agreement.
Hall of Fame
With the researcher's permissionThe people who made Flosa safer.
No names have been listed yet
Once the first valid reports are fixed, and with the researcher's permission, their name will be listed here.
Report a vulnerability
Send your report to the security email. A PGP key or online form has not been published yet; avoid sending raw sensitive information by email.
security@flosaerp.comA good report includes
- Steps to reproduce
- Security impact and the data exposed
- PoC or video
- Test environment (browser or app version)
- Your suggested severity
The more complete the report, the faster the review. Please do not publish details until the issue is fixed.