BIND 9 Bug Bounty Program

{
  "id": "bind-bug-bounty-program",
  "name": "BIND 9 Bug Bounty Program",
  "public": true,
  "managed": null,
  "targets": {
    "in_scope": [
      {
        "type": "open-source",
        "target": "https://gitlab.isc.org/isc-projects/bind9"
      }
    ],
    "out_of_scope": [
      {
        "type": "other",
        "target": "- gitlab.isc.org"
      },
      {
        "type": "other",
        "target": "- lists.isc.org"
      },
      {
        "type": "other",
        "target": "- Any asset that is not explicitly included in our program's scope"
      },
      {
        "type": "other",
        "target": "- Any third parties' or community assets (e.g. packages or versions not created and published by ISC)"
      },
      {
        "type": "other",
        "target": "- Any deprecated versions and versions other than the current stable/official version"
      },
      {
        "type": "other",
        "target": "- Any local implementation of the project/implementation belonging to third parties"
      },
      {
        "type": "other",
        "target": "- Vulnerabilities in the DNS protocol that are not specific to the BIND 9 implementation (while we are interested in these, they are out of scope of this Bug Bounty program)"
      },
      {
        "type": "other",
        "target": "- Any vulnerability that requires admin or admin-like access (see above for more details) — this includes access to files on disk, administrative interfaces (rndc, statistics channel), access to any shared key, privileges to write files on disk, and authenticated access to change the zone file contents (zone transfers, DNS update)"
      }
    ]
  },
  "disabled": false,
  "max_bounty": 10000,
  "min_bounty": 100
}