Security

Responsible disclosure & bug bounty policy

If you uncover a vulnerability in SpoofProxies, we want you to tell us about it. What is in scope, what we pay for, what we do not pay for and how to report are all set out here, so no one on either side is surprised.

Scope

In scope

This website, spoofproxies.com
The sign-in customer dashboard together with its API
Proxy credential handling, rotation links and API keys within the dashboard

Out of scope

Proxy gateways and modem hosts, as well as the mobile carrier networks behind them
Payment processors, Telegram, Cloudflare and email providers, which are third-party services
Marketing assets served from legacy CDN paths
Someone else's customer account or customer data

What we pay

Rewards are paid for impact you demonstrate on our systems or our customers. Amounts are in USD.

Critical

$100 – $250

Remote code execution on our servers
SQL injection that reads customer data or writes to it
Authentication bypass giving entry to any account with no credentials
Balance or payment manipulation that gets you proxies, credit or refunds without paying
Proxy credentials or personal data of other customers exposed at scale

High

$50 – $100

Reading or editing another customer's proxies, orders or account details through IDOR
Stored cross-site scripting that triggers inside another customer's or an admin's session
Escalating a customer account's privileges to admin functions
Server-side request forgery reaching internal services
Grabbing another account's session, API key or rotation link

Medium

$20 – $50

Cross-site request forgery able to change account state through an action
Reflected cross-site scripting that relies on the victim clicking a link
Rate limits bypassed to produce a demonstrated account takeover
Business logic or pricing errors whose financial impact is demonstrated

Low / Informational

We acknowledge and, where warranted, fix these; no payment. The complete list is below for you to check before you write the report.

Rules of engagement

First valid report wins. Duplicates and already-known issues are not eligible for payment. Root causes are paid once each, regardless of the endpoint count.
Prove it, then stop. Access only your own accounts and data. If a test would surface someone else's data, the first proof is where you stop and report — do not pivot, download or persist.
Do not degrade the service. Load testing, bulk automated fuzzing and any test aimed at proxy gateways, modem hosts or carrier networks are not allowed. Those are out of scope entirely.
Give us time. Wait for both our fix and 30 days to pass before you publish anything. When the fix is live, you will hear from us.
Severity is ours to set. We score the impact on our own systems and use the Bugcrowd Vulnerability Rating Taxonomy as the reference. We decide payment amounts at our discretion within the ranges above and pay through PayPal or USDT.

Safe harbour. Research that follows these rules is authorised. If your testing is in good faith and within scope, we will not pursue legal action against you, and we ask that you return that good faith: no extortion, no threats of disclosure, no “pay first, details later”.

What we do not pay for

Low or Informational is the most these are accepted as. Reading them and fixing what is worth fixing is what we do, but no bounty is issued, and a Critical or High label on the report changes nothing.

Sessions not revoked on logout, password reset or password change, so they live until the token expires
CSP, HSTS, X-Frame-Options or Referrer-Policy headers that are absent or “weak”, without a working exploit
Clickjacking that targets pages lacking a sensitive action
Cookie attributes for cookies that are not used for sessions
Email and username enumeration, including the timing and error-message kinds
Remarks about forgot-password, login or rate limiting without a demonstrated account takeover
Password policy critiques: length, complexity, common-password lists, absence of forced rotation
2FA left optional, or two-factor authentication not present at all
Self-XSS, or cross-site scripting only the attacker can trigger in their own session
CSRF on non-sensitive forms, including login, logout and language
Open redirects that expose no token or credential
Exposure of a software version, server banner, stack trace or path, without sensitive data
SPF, DKIM or DMARC configuration reports
Automated scanner findings not backed by a proof of concept
Brute-force attacks, resource exhaustion, denial of service or other load-generating tests
Socially engineering or phishing our staff or customers; physical attacks
Flaws in third parties we use: payment processors, Telegram, Cloudflare, email providers
Outdated library versions not backed by a working exploit against our deployment
Attacks that assume a man-in-the-middle position, a compromised device or a rooted phone
Best-practice tips, theoretical risks and reports that duplicate known issues

How to report

Email support@spoofproxies.com with the subject Security report. Each report needs the affected URL, exact steps to reproduce, the account you used and a proof of concept. Your report is acknowledged within 5 business days and gets a severity decision within 10 business days.

Machine-readable contact details are at /.well-known/security.txt.

Send a report

Policy last updated 2026-10-17.