Trade
Facilities
Language
English
Copyright © 2016 - 2025 Nobitex Ltd. All rights reserved,
V5.12.0
#63207bb
Nobitex Bug Bounty
Maintaining the security and protection of users' information and property is the most important responsibility of Nobitex; For this purpose We invite you to help us perform this responsibility better by sending a report to identify the vulnerabilities of the Nobitex site.
Send Report
| nobitex.ir | *.nobitex.ir | پنلهای بیزینسی | |
|---|---|---|---|
| Critical impact vulnerability | ۵۰ - ۲۵۰ | ۳۵ - ۱۶۰ | ۲۰ - ۱۰۰ |
| High impact vulnerability | ۸ - ۵۰ | ۵ - ۳۵ | ۳ - ۲۰ |
| Medium impact vulnerability | ۱ - ۸ | ۱ - ۵ | ۱ - ۳ |
| Low impact vulnerability | تا ۱ | تا ۱ | تا ۱ |
Rewards
Your time and expertise to identify Nobitex vulnerabilities is valuable; Nobitex tries to invite security professionals to participate in Bug Bunty by offering attractive and fair rewards. In this regard, awards have been determined based on the severity and importance of the reported vulnerability; The rewards will be announced to you through the official Nobitex email after the sent report has been judged and the vulnerability has been confirmed by the Nobitex security team.
Vital
+500,000,000
IRT
details
Critical
up to 250,000,000
IRT
details
High
up to 50,000,000
IRT
details
Average
up to 8,000,000
IRT
details
Low
up to 1,000,000
IRT
details
Rules
- Currently, reports related to nobitex.ir/mag do not include Bounty.
- If you discover a vulnerability (bug), please report it to us quickly and privately. Also, publishing the report is only possible with the coordination and approval of Nobitex.
- Due to the sensitivity of Nobitex user accounts, test the vulnerability only on your own user accounts. Avoid accessing, changing or disclosing users' personal information without permission.
- Publication of vulnerability reports in public media or social networks requires Nobitex approval.
- Your report will be confirmed if it can be exploited.
- If you discover the vulnerability of the information meeting, avoid publishing sensitive information and delete all information after your report is approved and you receive the award.
- Subdomains used for testing or for debugging or similar are not accepted in Nobitex Bug Bounty.
- A similar vulnerability found in two or more different domains will be eligible for only one reward.
Out of scope vulnerabilities
- Self XSS
- Internal open redirect
- Brute Forcing accounts
- DOS/DDOS attacks
- Vulnerabilities related to rate limit are considered outside the scope of bug bounty until they lead to a vulnerability with a higher degree of importance.
- Social engineering attacks
- Physical attacks or exploits
- Vulnerabilities on third-party websites or applications
- Vulnerabilities already reported by others
- Vulnerabilities requiring physical access to devices
- Spam or phishing vulnerabilities
- Clickjacking without evidence of a vulnerability
- Issues related to outdated or unsupported browsers/clients
- Email spoofing
- lack of security headers
- Issues related to insecure SSL/TLS cipher suites or protocols
- SSRF (DNS Query Only)
- Open Redirect (POST-Based)
- Captcha brute force
- Exposed Admin Portal To Internet
- Public Admin Login Page
Report Feature
- Write the report in full details so that the review team can reproduce the vulnerability as quickly as possible.
- Sending a video along with a text report helps the speed and accuracy of the judging team's review.
- In the text report, describe the vulnerability step by step and if you have used a special tool or payload; Be sure to mention it.
- Submit each vulnerability in a separate report for better judgment.
- State the version of the browser and the operating system used.
Send your reports to security@nobitex.ir
Nobitex Support
support Nobitex
What topic do you need help for?
If your topic is not listed above, select Online chat.