--- title: "Bug Bounty" date: 2026-08-06 author: "Janhvi Kalariya" --- # Bug Bounty # Bug Bounty ## Desku.io Bug Bounty Program – Help Us Build a Safer HelpDesk At Desku.io, we work closely with the security community to protect the customer data that businesses trust us with. Security researchers play a real role in keeping our HelpDesk platform safe, and we take every responsible disclosure seriously. If you’ve found a potential vulnerability in our platform, we want to hear from you. Submit a valid report through our Bug Bounty Program for HelpDesk Software, and we’ll reward you for helping us stay secure. Desku is operated by Hosted.com® LLC. This program is open to all researchers who comply with the terms and Code of Conduct below. ### How to Report a Security Vulnerability Send your report to info@desku.io. To be reviewed, every submission must include the following: - Attack Vector: Describe how the vulnerability can be reached and triggered. - Step-by-Step Exploitation Instructions: Walk us through exactly how the vulnerability is exploited. - Proof of Concept (PoC): Provide working evidence that the exploit succeeds. - Security Impact: Explain what could happen if this vulnerability is not mitigated. If you’re unsure whether a finding is in scope, submit it anyway with full technical context. We’ll review it and let you know. [ Submit Your Report ](mailto:info@desku.io) ### Bounty Reward Tiers Desku pays between $100 and $750 per valid, unique security vulnerability report. Reward amounts depend on the severity and exploitability of the issue. The tiers below define what qualifies at each level. ### Low Tier Bounties ($100 reward) Issues that have limited impact, require low privileges, or affect only a small part of the platform: - Open redirect with security relevance. - IDOR with low-sensitivity data exposure. - Information disclosure of non-sensitive data. - Minor authorization flaws without user-wide exposure. ### Medium Tier Bounties ($150 reward) Issues that expose user data, weaken account security, or enable meaningful abuse: - IDOR exposing sensitive user or ticket data. - Weak authorization bypass on limited actions. - Email verification / password reset abuse with real impact. - Sensitive information disclosure. - Partial privilege escalation. ### High Tier Bounties ($200 reward) Issues that expose sensitive customer data, compromise accounts, or affect user isolation: - SQL Injection (SQLi). - Auth bypass. - Privilege escalation. - Server-Side Request Forgery (SSRF) with internal network access. - Sensitive data compromise. - Server-side request forgery to internal services. - Broken access control affecting multiple users. ### Critical Tier Bounties ($300 reward) Issues that lead to full platform compromise, remote code execution, or major customer data exposure: - Remote Code Execution (RCE). - Full user escape / cross-user compromise. - Mass customer data exposure. - Root or server-level compromise. - Arbitrary command execution. - Critical deserialization vulnerabilities. - Full database dump or secrets exposure. - Complete platform takeover. Reward amounts are per valid report. Duplicate reports, theoretical findings, or submissions without a working proof of concept are not eligible. Final decisions on reward amounts are made by the Desku security team. ### Eligibility & Program Requirements To qualify for a reward, your responsible disclosure vulnerability report must meet all of the following requirements. Submissions that do not meet these criteria will not be eligible, regardless of the severity of the finding. - Be the first to responsibly disclose the vulnerability to Desku. - Report a bug that compromises user data, circumvents system protections, or enables unauthorized access to the platform. - Include a working proof of concept that demonstrates successful exploitation. - Comply with all program terms and the Code of Conduct on this page. - Not be a current or former employee, contractor, or family member of Desku.io or Hosted.com® LLC. By participating in this program, you agree to act in good faith and in line with responsible disclosure standards. Desku reserves the right to modify or cancel this program at any time. ### Code of Conduct We ask that all researchers act in good faith toward our users, their data, and our infrastructure. If you follow these rules, we won’t take legal or administrative action against you. White Hat researchers are always appreciated. - Do not use automated scanners, DoS tools, DDoS tools, or brute-force tools during testing. - Never access, manipulate, or destroy real user data. Use test accounts only. - Do not impact live users or disrupt platform availability with your testing. - Report any vulnerability you discover within 48 hours of finding it. - Do not attempt social engineering, phishing, or physical attacks against Desku employees, users, or infrastructure. - Do not publicly disclose any vulnerability before Desku has reviewed and addressed the issue. Reports that break these rules will be closed without a reward. Repeated violations may result in a permanent ban on future submissions. ### Out of Scope – Vulnerabilities We Are Not Reviewing The following types of reports will be closed as informational, or declined, without reward. Reports that are purely theoretical, lack a working proof of concept, or depend on unrealistic user interaction do not qualify under this program. ##### Best Practice & Informational Findings We need demonstrated exploitability, not configuration recommendations or hardening suggestions. - Missing security headers without exploitability. - Missing or weak Content Security Policy (CSP). - Missing HTTP Strict-Transport-Security (HSTS) headers. - Missing X-Frame-Options. - Missing Referrer-Policy. - Missing Permissions-Policy. - Missing X-Content-Type-Options. - Missing SameSite cookie attribute without exploitability. - Missing cookie flags on non-sensitive cookies. - Presence of auto-complete on forms. - Version disclosure or banner grabbing. - Stack or framework fingerprinting. - Server header disclosure. - Public or internal IP disclosure without exploitation. - Open ports without a verified vulnerability. - Disclosure of public files or paths (robots.txt, sitemap.xml, /.well-known/, public assets, etc.). - Source map disclosure without sensitive information. - Error messages without sensitive data leakage. - GraphQL introspection enabled. - Hypertext Transfer Protocol (HTTP) OPTIONS or TRACE methods are enabled without impact. - HTTP/2 informational findings. - IPv6 exposure without vulnerability. - Content Delivery Network (CDN)/Web Application Firewall (WAF) fingerprinting. - WHOIS or reverse Domain Name System (DNS) information disclosure. ##### Authentication, Session & Account Management Authentication-related findings are only considered in scope when real, demonstrable exploitation impact is shown. - Login Cross-Site Request Forgery (CSRF). - Logout Cross-Site Request Forgery (CSRF). - Unauthenticated CSRF with no meaningful impact. - CSRF token disclosure in frontend HTML. - Missing email verification for account registration or usage. - Opening tickets or using features without email verification. - Session expiration recommendations. - Session invalidation recommendations. - Password complexity or password reuse suggestions. - Password reset expiration recommendations. - User enumeration. - Username / email disclosure via login or recovery forms. - Missing CAPTCHA. - Weak or missing rate limiting without demonstrated abuse impact. - Lack of rate limiting for One-Time Password (OTP), verification, login, registration, or password reset flows, unless account takeover is shown. - Brute-force concerns without practical exploitation. ##### Client-Side / Browser-Only Issues Client-side issues are only eligible if they cross a meaningful security boundary and cannot be resolved through standard browser behavior. - Self Cross-Site Scripting (Self-XSS). - Tabnabbing. - window.opener related issues. - Hyperlink injection in emails. - Clickjacking on non-sensitive pages. - Browser autofill behavior. - Browser password manager behavior. - Clipboard manipulation without exploitation. - Social engineering–only attacks. - Issues affecting only outdated or unsupported browsers. - Issues requiring browser extensions, local malware, or compromised devices. - Physical access attacks. - Attacks requiring rooted, jailbroken, or emulated devices. ##### Infrastructure, DNS & SSL/TLS Findings Infrastructure findings require a working proof of concept that demonstrates real exploitability against Desku-controlled assets. - Domain Name System (DNS) misconfigurations without exploitability. - Missing Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), or Domain-based Message Authentication, Reporting, and Conformance (DMARC) records. - Domain Name System Security Extensions (DNSSEC) recommendations. - Secure Sockets Layer/Transport Layer Security (SSL/TLS) best-practice recommendations. - Weak or insecure SSL/TLS ciphers without a working proof of concept. - Host header injection without demonstrated exploitability. - Custom domain, subdomain, DNS, SSL, or certificate issues on customer-owned domains. - DNS verification failures on customer-managed infrastructure. ##### Injection & Input Validation Findings Injection reports require a working exploit with a clear security impact. Theoretical or non-executable injection is not in scope. - CSV/Excel formula injection requiring local file opening only. - HTML injection without script execution. - Reflected input without execution capability. - Open redirects requiring user self-action only. - Carriage Return Line Feed (CRLF) injection without security impact. - HTTP parameter pollution without impact. - Path disclosure without sensitive information. - File upload issues without code execution or unauthorized access. - Server-Side Request Forgery (SSRF) is limited to localhost-only access. - Cache poisoning without practical exploitation. ##### Third-Party & Customer Environment Issues We do not accept reports that only affect third-party platforms, customer-managed environments, or integrations outside our direct control. - WordPress vulnerabilities on customer-managed websites. - Extensible Markup Language – Remote Procedure Call (XML-RPC) brute-force attacks on customer WordPress installations. - Shopify, Meta, WhatsApp, Stripe, Firebase, Postmark, Zapier, Facebook, or similar third-party platform vulnerabilities, unless cross-tenant impact or compromise of our platform is demonstrated. - Misconfigured integrations entered by customers (Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol (IMAP), API keys, webhooks, tokens, etc.). - Customer-owned hosting, DNS, or SSL configuration issues. - Embedded app framing or Content Security Policy (CSP) exceptions required by third-party platforms. ##### Abuse, Spam & Denial-of-Service Style Reports These are not considered security vulnerabilities unless platform-wide impact or tenant isolation bypass can be demonstrated. - Spam submissions. - Spam tickets or chat flooding. - Abuse reports without a security boundary crossed. - Large file uploads without demonstrated platform-wide denial of service. - Public API abuse without cross-tenant impact. - Widget or embed flooding without infrastructure impact. - Email rating / public route abuse without privilege escalation. - Race conditions that do not affect security guarantees. ##### Unsupported or Invalid Reports The following types of submissions will be closed without reward or further investigation. - Automated scanner output without manual verification. - Reports without reproducible steps. - Reports without a working proof of concept. - Purely theoretical attacks. - Duplicate reports. - AI-generated reports without validation. - Missing exploit chain or unclear impact. - Vulnerabilities requiring unrealistic user interaction. - Reports based solely on outdated software version disclosure without a known exploitable vulnerability. ### Bug Bounty Program HelpDesk Software FAQs How do I submit a bug bounty report to Desku? Send your report to *info@desku.io*. Your submission must include the attack vector, step-by-step exploitation instructions, a working proof of concept, and a description of the potential security impact. Submissions that are missing any of these will not be reviewed. How much does Desku pay for security vulnerabilities? Desku pays between $100 and $750 per valid report, depending on severity. Low-severity issues earn $100, medium-severity issues earn $250, high-severity issues earn $500, and critical-severity issues earn $750. All amounts are per valid, unique report. What happens if I report something that’s out of scope? Your report will be closed as informational and will not receive a reward. If you’re unsure whether something qualifies, include full technical context with your submission, and we’ll take a look. Repeated out-of-scope submissions may result in a ban on future submissions from your account. Can I test on production accounts or real user data? No. You must never access, manipulate, or destroy real user data. All testing must be carried out using test accounts only. Any researcher found accessing real user data will be disqualified from the program and may face further action. Is the Desku.io bug bounty program public? Yes. The Desku bug bounty program is public and open to all security researchers who comply with the program terms and *Code of Conduct*. No invitation is required. Who operates Desku.io? Desku is a product of *Hosted.com® LLC*. All program decisions, including helpdesk security vulnerability reward amounts and eligibility determinations, are made by the Desku security team and are final. Send your report to *info@desku.io*. Your submission must include the attack vector, step-by-step exploitation instructions, a working proof of concept, and a description of the potential security impact. Submissions that are missing any of these will not be reviewed. Desku pays between $100 and $750 per valid report, depending on severity. Low-severity issues earn $100, medium-severity issues earn $250, high-severity issues earn $500, and critical-severity issues earn $750. All amounts are per valid, unique report. Your report will be closed as informational and will not receive a reward. If you’re unsure whether something qualifies, include full technical context with your submission, and we’ll take a look. Repeated out-of-scope submissions may result in a ban on future submissions from your account. No. You must never access, manipulate, or destroy real user data. All testing must be carried out using test accounts only. Any researcher found accessing real user data will be disqualified from the program and may face further action. Yes. The Desku bug bounty program is public and open to all security researchers who comply with the program terms and *Code of Conduct*. No invitation is required. Desku is a product of *Hosted.com® LLC*. All program decisions, including helpdesk security vulnerability reward amounts and eligibility determinations, are made by the Desku security team and are final. ### Ready to Report a Vulnerability? If you’ve found a security issue in Desku.io, submit your report today. Follow the guidelines above, include a working proof of concept, and we’ll take it from there. [ Submit Your Report ](mailto:info@desku.io)