FloQast

{
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 854,
  "average_time_to_first_program_response": 5,
  "average_time_to_report_resolved": 4493,
  "handle": "floqast",
  "id": 0,
  "managed_program": false,
  "name": "FloQast",
  "offers_bounties": true,
  "offers_swag": true,
  "response_efficiency_percentage": 78,
  "submission_state": "open",
  "url": "https://hackerone.com/floqast",
  "website": "https://floqast.com",
  "targets": {
    "in_scope": [
      {
        "asset_identifier": "*.eu.floqast.app",
        "asset_type": "WILDCARD",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "All domains for FloQast's Core Application for European Customers",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "*.floqast.app",
        "asset_type": "WILDCARD",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "All domains for FloQast's Core Application for US Customers",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "api-eu.floqast.app",
        "asset_type": "URL",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Public API for FloQast's Core Application for European Customers",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "https://*.floqast.engineering",
        "asset_type": "WILDCARD",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "If you discover a domain that is accessible to the public and returns a 200 OK status code (or similar) with actual page content, please report it. However, do not submit reports for pages that only display generic content or standard firewall blocking messages. A valid submission must demonstrate that you have bypassed access controls to view functional application data or internal interfaces.\n\nExceptions:\nThe host https://verdaccio.security-eng.floqast.engineering/ is intentionally public and is excluded from the general restriction above. This server functions as a private NPM registry for public packages. For this specific host, we are exclusively interested in vulnerabilities that allow an attacker to bypass authentication. Specifically, we want to know if you can pull packages or push new packages without proper authorization. Reports regarding the public visibility of the registry or general informational findings for this host will be closed.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      }
    ],
    "out_of_scope": [
      {
        "asset_identifier": "*.floqast.com",
        "asset_type": "WILDCARD",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "FloQast's Marketing Website",
        "integrity_requirement": null,
        "max_severity": "none"
      },
      {
        "asset_identifier": "*.floqast.studio",
        "asset_type": "WILDCARD",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "FloQast's Marketing Website for our Digital Entertainment Division",
        "integrity_requirement": null,
        "max_severity": "none"
      },
      {
        "asset_identifier": "Any Asset Not Specifically Listed as In-Scope",
        "asset_type": "OTHER",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "Any domain, device, or asset not specifically listed as \"In-Scope\" for this program.",
        "integrity_requirement": null,
        "max_severity": "none"
      },
      {
        "asset_identifier": "s3://floqast",
        "asset_type": "OTHER",
        "availability_requirement": "none",
        "confidentiality_requirement": "none",
        "eligible_for_bounty": false,
        "eligible_for_submission": false,
        "instruction": "The \"floqast\" S3 bucket is not owned by us. We have static code analysis tools that prevent developers from connecting any of our services to it.",
        "integrity_requirement": "none",
        "max_severity": "none"
      }
    ]
  }
}