Scope
In shortTest only these four staging hosts. Never test production.
- staging.app.klao.eu
- staging.portal.klao.eu
- staging.widget.klao.eu
- staging.sso.klao.eu
Every path and API served from these hosts is in scope.
Out of scope: klao.eu, app.klao.eu and every other production host, any klao.eu subdomain not listed above, customer websites that embed the KLAO widget, and third-party services we use.
Rewards
In shortWe pay €50 to €200 per valid vulnerability, based on its severity.
| Severity | Reward | Examples |
|---|---|---|
| CriticalRemote code execution, SQL injection that reads or changes data, login bypass or account takeover through SSO | €200 | Remote code execution, SQL injection that reads or changes data, login bypass or account takeover through SSO |
| HighStored XSS that runs for other users, access to another organization's texts or accounts, SSRF to internal services, privilege escalation | €100 | Stored XSS that runs for other users, access to another organization's texts or accounts, SSRF to internal services, privilege escalation |
| MediumCSRF on a sensitive action, reflected XSS, access control flaws that expose limited data | €50 | CSRF on a sensitive action, reflected XSS, access control flaws that expose limited data |
| LowLimited information disclosure, open redirect, issues that need unlikely user interaction | No reward | Limited information disclosure, open redirect, issues that need unlikely user interaction |
- We rate severity with CVSS 3.1 and the real impact on KLAO and its users. We make the final call and explain it.
- The first valid report of an issue gets the reward. Later reports of the same issue are duplicates.
- One reward per root cause. If several bugs chain into one attack, send them as one report.
- We pay by bank transfer in euros. You handle any taxes on the reward.
Rules
In shortUse your own test accounts, touch no one else's data, and don't break anything.
Do
- Create your own accounts for testing.
- Stop as soon as you reach personal data or someone else's content. Don't keep a copy, and report it right away.
- Keep automated tools to 5 requests per second or fewer.
- Keep every detail confidential until we fix the issue and agree on disclosure.
Don't
- Run denial of service, load, or stress tests.
- Phish, call, or trick KLAO staff or customers, or try to get into our offices.
- Change or delete data that isn't yours, or leave backdoors or malware behind.
- Spam forms or create accounts in bulk.
- Use AI agents or AI-driven scanners to test our systems. Test by hand, or with standard tools that stay within the rate limit.
- Ask for payment as a condition for sharing details. That is extortion, and we don't reward it.
Not eligible
In shortReports need a real, demonstrated security impact. These don't qualify.
- Scanner output without a working proof of concept
- Reports written by AI tools without a proof of concept you reproduced yourself
- Missing security headers or cookie flags with no demonstrated impact
- Clickjacking on pages with no sensitive action
- CSRF on logout or other actions with no security impact
- Self-XSS, or XSS that needs the victim to paste code
- Missing SPF, DKIM, or DMARC records
- Missing rate limits on endpoints that don't handle login or codes
- Checking whether a user or email exists through login, signup, or password reset
- Software version numbers, banners, or error pages without sensitive data
- TLS settings such as weak ciphers, without a working attack
- Text injection without HTML or script
- Bugs that only work in outdated browsers or on rooted devices
- Bugs in third-party services or libraries with no proven impact on KLAO
- Denial of service and social engineering
How to report
In shortEmail abdullah@klao.eu with enough detail for us to reproduce the issue.
Use the subject line [Bug Bounty] Severity: short title. Write in English or German, and include:
- The affected host and full URL
- The type of vulnerability and the severity you think it has
- Steps to reproduce it, one by one
- Proof: requests and responses, screenshots, or a short video
- The impact: what an attacker could do with it
- The name or handle you want us to use if we credit you
After you report
In shortWe reply within 3 business days and keep you updated until the fix.
- We confirm we received your report within 3 business days.
- We reproduce it and tell you the severity within 10 business days.
- We fix it and tell you when the fix is live.
- We pay the reward within 30 days after we confirm the vulnerability.
Want to write about your finding? Ask us first. Once the fix is live, we're open to coordinated disclosure.
Safe harbor
In shortFollow these rules and we won't take legal action against you.
If you act in good faith and follow this policy, we consider your research authorized. We won't take legal action against you or report you to law enforcement for it. If someone else takes legal action against you over research you did under this policy, we'll make it known that your work was authorized.
Not sure if something is allowed? Ask at abdullah@klao.eu before you test it.
Who can take part
In shortAnyone 18 or older who isn't on KLAO's team.
- You are 18 or older, or have a parent's or guardian's permission.
- You don't work for KLAO now and didn't in the last 12 months, as an employee or contractor.
- You don't live in a country under EU sanctions, and you follow the laws that apply to you.
We may change or end this program at any time. Reports sent before a change follow the rules that applied when you sent them.