TigerProxies logo
Log inCreate account
Log inRegister
Security

Responsible disclosure & bug bounty policy

When you find a vulnerability in TigerProxies, we want to hear from you. What's in scope, what we pay for, what we skip, and how to report are all here, so there are no surprises either way.

Scope

In scope

  • This website, tigerproxies.net
  • The sign-in customer dashboard together with its API
  • How rotation links, API keys and proxy credentials are handled inside the dashboard

Out of scope

  • Proxy gateways, modem hosts, and mobile carrier networks sitting behind them
  • Payment processors, Telegram, Cloudflare and email providers, which are third-party services
  • Marketing assets served from legacy CDN paths
  • Another customer's account, or data that is someone else's

What we pay

Rewards go to demonstrated impact on our systems or on our customers. Amounts are in USD.

Critical
$100 – $250
  • Remote code execution on our servers
  • SQL injection that pulls or alters customer data
  • Breaking into any account without its credentials via an authentication bypass
  • Rigging payments or balances — proxies, credit or refunds without paying for them
  • Mass exposure of other customers' personal data or proxy credentials
High
$50 – $100
  • Peeking at or changing another customer's proxies, orders or account details (IDOR)
  • Stored cross-site scripting that lands in another customer's or an admin's session
  • Privilege escalation letting a customer account reach admin functions
  • Server-side request forgery reaching internal services
  • Snatching an API key, rotation link or session from another account
Medium
$20 – $50
  • Forged cross-site requests that change account state
  • Reflected cross-site scripting triggered only by the victim clicking a link
  • Rate-limit bypass that results in an account takeover you demonstrate
  • Pricing or business-logic mistakes with a demonstrated financial hit
Low / Informational
$0

No payout, but we acknowledge them and fix where warranted. Before writing the report, check the full list below.

What we do not pay for

The ceiling for these is Low or Informational. We go through them and fix what deserves a fix, but no bounty goes out, and tagging the report Critical or High makes no difference.

  • A session left alive by a password reset, password change or logout until its token expiry
  • Security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) missing or “weak” but not backed by a working exploit
  • Clickjacking a page that holds no sensitive action
  • How non-session cookies set their attributes
  • Finding valid emails or usernames, including from timing or error messages
  • Comments on forgot-password, login or rate limits, unless an account takeover is demonstrated
  • Opinions on password length, complexity, common-password lists or no forced rotation
  • Two-factor authentication absent, or 2FA only opt-in
  • XSS that only fires in the attacker's own session, self-XSS included
  • Login, logout, language or other non-sensitive forms hit by CSRF
  • Open redirects where no token or credential gets out
  • Showing a software version, server banner, stack trace or path without sensitive data
  • SPF, DKIM or DMARC configuration reports
  • Whatever an automated scanner spits out, without a proof of concept
  • Any test that creates load, such as denial of service, resource exhaustion or brute force
  • Physical attacks, or phishing and social engineering against our staff or customers
  • Weaknesses at third parties we use, such as payment processors, Telegram, Cloudflare or email providers
  • Outdated library versions not backed by a working exploit against our deployment
  • Attacks relying on a compromised device, a man-in-the-middle foothold or a rooted phone
  • Theoretical risks, duplicates of issues we know about, and best-practice recommendations

Rules of engagement

  1. First valid report wins. Duplicates and reports of issues already on our radar get no payout. A single payout covers a root cause, however many endpoints it reaches.
  2. Prove it, then stop. Access only your own accounts and data. The moment a test would expose someone else's data, stop at the first proof and report it — do not pivot, download or persist.
  3. Do not degrade the service. Leave out load testing, mass automated fuzzing and any test against proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
  4. Give us time. Keep it unpublished until we fix the issue and 30 days are up. We'll message you when a fix is live.
  5. Severity is ours to set. Impact gets rated on our own systems, using the Bugcrowd Vulnerability Rating Taxonomy as the benchmark. Payout size is our call within the ranges above, paid out by PayPal or USDT.
Safe harbour. Research that follows these rules is authorised. We won't come after you legally for good-faith testing within scope, and we ask you to return that good faith: no extortion, no threats of disclosure, no “pay first, details later”.

How to report

Email support@tigerproxies.net with the subject Security report. List the affected URL, the exact steps to reproduce it, the account you used and a proof of concept. You get an acknowledgment inside 5 business days and a severity call inside 10 business days.

Machine-readable contact details are at /.well-known/security.txt.

Send a report

Policy last updated 2026-10-17.