Qboid Labs – Bug Bounty & Responsible Disclosure Program

​

At Qboid Labs, we take the security of our software, infrastructure, and customers seriously. We welcome security researchers who help us identify and responsibly disclose vulnerabilities in our products and services.

We operate a paid bug bounty program and may reward researchers who report valid, previously unknown security vulnerabilities in accordance with this policy.

​

Scope

This program covers software developed and maintained by Qboid Labs, as well as publicly accessible systems and services owned and operated by Qboid Labs.

Third-party systems, customer environments, and infrastructure not directly controlled by Qboid Labs are excluded unless explicitly authorized.

​

Website Hosting

The Qboid Labs website is hosted externally by Wix. Security testing of the website and its underlying infrastructure must comply with Wix's applicable security policies, terms of service, and vulnerability disclosure guidelines.

This bug bounty program does not authorize testing of Wix infrastructure or services beyond what Wix explicitly permits. Vulnerabilities affecting Wix-managed infrastructure should be reported in accordance with Wix's own vulnerability disclosure procedures.

​

Rules of Engagement

Researchers participating in this program must:

• Act in good faith and avoid disrupting services or affecting legitimate users.

• Limit testing to systems within the defined scope.

• Avoid accessing, modifying, or extracting data belonging to other users or third parties.

• Refrain from denial-of-service attacks, social engineering, phishing, physical attacks, and destructive testing.

• Stop testing and notify us immediately if sensitive information is inadvertently accessed.

• Keep vulnerability details confidential until disclosure has been coordinated with Qboid Labs.

 

Reporting Vulnerabilities

Send vulnerability reports to contact@qboidlabs.io.

Your email subject must contain "RESPONSIBLE DISCLOSURE".

Please include a clear description of the vulnerability, affected product or service, steps to reproduce, potential security impact, and any relevant proof-of-concept material.

 

Rewards

Qboid Labs offers monetary rewards for eligible vulnerability reports. Reward amounts are determined individually based on severity, demonstrated impact, report quality, and exploitability.

Rewards are discretionary and subject to validation by Qboid Labs. Duplicate reports, previously known issues, theoretical vulnerabilities without demonstrable impact, and findings outside the defined scope are generally not eligible.

​

We will communicate any offered reward and applicable payment arrangements directly with the researcher.

Coordinated Disclosure

​

We ask researchers not to publicly disclose vulnerabilities before Qboid Labs has had a reasonable opportunity to investigate and remediate them. Public disclosure should be coordinated and agreed upon in advance.

 

Safe Harbor

Qboid Labs will not initiate legal action against researchers for good-faith security research conducted in compliance with this policy and applicable law.

This commitment applies only to systems and rights controlled by Qboid Labs and does not authorize activities against third-party systems or data.

 

Program Conditions

Qboid Labs reserves the right to determine eligibility, modify the scope, adjust rewards, or discontinue this program at any time. Participation does not guarantee a reward.

 

Contact: contact@qboidlabs.io

Email subject: RESPONSIBLE DISCLOSURE