<commit_before>{% extends "security/base.html" %}

{% block page_title %}Mozilla Web Application Security Bug Bounty FAQ{% endblock %}

{% block breadcrumbs %}
  <nav class="breadcrumbs">
    <a href="{{ url('mozorg.home') }}">{{ _('Home') }}</a> &gt;
    <a href="{{ url('security.index') }}">{{ _('Mozilla Security') }}</a> &gt;
    <a href="{{ url('security.bug-bounty') }}">{{ _(' Bug Bounty ') }}</a> &gt;
  </nav>
{% endblock %}

{% block article %}
  <article class="section-content" itemscope itemtype="http://schema.org/Article">
    <header>
      <h1 itemprop="name" class="title-shadow-box">Web Application Security Bug Bounty FAQ</h1>
    </header>

    <div itemprop="articleBody">
      <p>This FAQ covers websites and services. If you are reporting on a client software issue
        (e.g. a security issue in the Firefox browser), please see the
        <a href="{{ url('security.bug-bounty.faq') }}">Client Security Bug Bounty Program FAQ.</a>
        For more about the background of the bug bounty program see the
        <a href="{{ url('security.bug-bounty') }}">official guidelines</a>
        governing the program.</p>

      <h3>General questions</h3>
      <ul>
        <li><a href="#why">Why do we include web applications as part
          of our security Bug Bounty Program?</a></li>
        <li><a href="#howto">How can I find potential vulnerabilities
          and are there things I shouldn't do in trying to find them?</a></li>
        <li><a href="#bounty-amount">Is the amount of the bounty
          different for web applications vulnerabilities?</a></li>
        <li><a href="#severity-ratings">Is there a list of severity ratings
          with examples?</a></li>
      </ul>

      <h3>Eligible bugs</h3>
      <ul>
        <li><a href="#eligible-bugs">Which domains and web applications will be
          considered to be part of the bug bounty?</a></li>
        <li><a href="#issues">What types of issues will be considered as
          part of the bounty program?</a></li>
        <li><a href="#dos-bugs">Why won't you provide a reward for denial of service
          bugs?</a></li>
        <li><a href="#sites-not-listed">What about sites which are not listed?</a></li>
      </ul>

      <h3>Bug reporting</h3>
      <ul>
        <li><a href="#what-next">Once I have found a vulnerability,
          what next?</a></li>
        <li><a href="#nondisclosure">If I report the bug directly to you,
          do I have to keep the bug confidential and not publish information
          about it in order to receive a reward?</a></li>
        <li><a href="#cooperation">I don’t have the time or desire to work
          with you further in investigating and fixing the bug; can I still get a
          bug bounty reward?</a></li>
      </ul>

      <h2>General questions</h2>
      <dl class="faq">
        <dt class="question" id="why">Why do we include web applications
          as part of our security Bug Bounty Program?</dt>
        <dd class="answer">
          <p>Mozilla client software relies on web services, and Mozilla’s community uses
          websites and services to communicate and coordinate activity.
          Our goal is to make our products and services more secure.
          Mozilla community members submitted bugs before we had an official bounty program
          to reward researchers. The bounty program is designed to incentivize bug reporting towards the websites,
          services, and types of bugs we’d like community members to focus on.</p>
        </dd>

        <dt class="question" id="howto">How can I find potential vulnerabilities
          and are there things I shouldn’t do in trying to find them?</dt>
        <dd class="answer">
          <p>We have received many questions around how to find web application
            security issues. The most common concern is the use of automatic tools.
            We ask that people don’t use automatic tools against our web services
            as it is important to maintain our services and availability. We do
            encourage people to examine typical areas for vulnerabilities such as
            authentication and session management. Since our code is open source, you are
            encourage to run on the software on your own server instance or just look
            at the source code for potential issues.</p>
            <p>On Mozilla’s Wiki, you can find information about some of our
              <a href="https://wiki.mozilla.org/Security/TestingToolchains/">security testing toolchains.</a></p>
            <p>See the list below for the domains and applications which are in scope.</p>
        </dd>

        <dt class="question" id="bounty-amount">Is the amount of the bounty
          different for web applications vulnerabilities?</dt>
        <dd class="answer">
          <p>Payments vary according to the severity of the issue, with the range
            starting at $500 (US) for moderate severity and up to $3000 (US) for
            High or Critical vulnerabilities.</p>
        </dd>

        <dt class="question" id="severity-ratings">Is there a list of severity
          ratings with examples?</dt>
        <dd class="answer">
          <p>Yes, here it is:
            <a href="https://wiki.mozilla.org/WebAppSec/Web_App_Severity_Ratings">
              Web Application Severity Ratings</a></p>
              The bounty committee’s reward is based on the security and privacy
              impact of the bug and ultimately the importance of the website or service.
        </dd>
      </dl>

      <h2>Eligible bugs</h2>
      <dl class="faq">
        <dt class="question" id="eligible-bugs">Which domains and web applications
          will be considered to be part of the bug bounty?</dt>
        <dd class="answer">
          <p>Below is the list of domains eligible for Mozilla’s website and services
            security bug bounty. Please check it regularly, as it changes over time.</p>

          <h4>www.mozilla.com/org</h4>
          <ul>
          	<li>www.mozilla.com</li>
          	<li>www.mozilla.org</li>
          	<li>www.firefox.com</li>
          	<li>www.getfirefox.com</li>
          </ul>

          <h4>ABSearch</h4>
          <ul>
          	<li>Search.services.mozilla.com</li>
          </ul>

          <h4>Addons.mozilla.org</h4>
          <ul>
          	<li>addon.mozilla.org</li>
          	<li>addons.mozilla.org</li>
          	<li>blocklist.addons.mozilla.org</li>
          	<li>builder.addons.mozilla.org</li>
          	<li>controller-review.apk.firefox.com</li>
          	<li>controller.apk.firefox.com</li>
          	<li>services.addons.mozilla.org</li>
          	<li>static.addons.mozilla.net</li>
          	<li>versioncheck-bg.addons.mozilla.org</li>
          	<li>Versioncheck.addons.mozilla.org</li>
          </ul>

          <h4>bugzilla.mozilla.org</h4>
          <p>
            <strong>Please don’t use automated scanners and create bugs for testing on the production instance.</strong>
            Install your own local copy for testing from
            <a href="https://github.com/mozilla/webtools-bmo-bugzilla">https://github.com/mozilla/webtools-bmo-bugzilla</a>.
          </p>
          <ul>
          	<li>bugzilla.mozilla.org</li>
          </ul>

          <h4>Product Delivery</h4>
          <ul>
          	<li>download-installer.cdn.mozilla.net</li>
          	<li>Download.mozilla.org</li>
          </ul>

          <h4>AUS/Balrog</h4>
          <ul>
          	<li>aus3.mozilla.org</li>
          	<li>aus4.mozilla.org</li>
          	<li>aus5.mozilla.org</li>
          	<li>Aus.mozilla.org</li>
          </ul>
<commit_msg>Removing hostnames from eligible list. Hosts decomissioned.<commit_after>{% extends "security/base.html" %}

{% block page_title %}Mozilla Web Application Security Bug Bounty FAQ{% endblock %}

{% block breadcrumbs %}
  <nav class="breadcrumbs">
    <a href="{{ url('mozorg.home') }}">{{ _('Home') }}</a> &gt;
    <a href="{{ url('security.index') }}">{{ _('Mozilla Security') }}</a> &gt;
    <a href="{{ url('security.bug-bounty') }}">{{ _(' Bug Bounty ') }}</a> &gt;
  </nav>
{% endblock %}

{% block article %}
  <article class="section-content" itemscope itemtype="http://schema.org/Article">
    <header>
      <h1 itemprop="name" class="title-shadow-box">Web Application Security Bug Bounty FAQ</h1>
    </header>

    <div itemprop="articleBody">
      <p>This FAQ covers websites and services. If you are reporting on a client software issue
        (e.g. a security issue in the Firefox browser), please see the
        <a href="{{ url('security.bug-bounty.faq') }}">Client Security Bug Bounty Program FAQ.</a>
        For more about the background of the bug bounty program see the
        <a href="{{ url('security.bug-bounty') }}">official guidelines</a>
        governing the program.</p>

      <h3>General questions</h3>
      <ul>
        <li><a href="#why">Why do we include web applications as part
          of our security Bug Bounty Program?</a></li>
        <li><a href="#howto">How can I find potential vulnerabilities
          and are there things I shouldn't do in trying to find them?</a></li>
        <li><a href="#bounty-amount">Is the amount of the bounty
          different for web applications vulnerabilities?</a></li>
        <li><a href="#severity-ratings">Is there a list of severity ratings
          with examples?</a></li>
      </ul>

      <h3>Eligible bugs</h3>
      <ul>
        <li><a href="#eligible-bugs">Which domains and web applications will be
          considered to be part of the bug bounty?</a></li>
        <li><a href="#issues">What types of issues will be considered as
          part of the bounty program?</a></li>
        <li><a href="#dos-bugs">Why won't you provide a reward for denial of service
          bugs?</a></li>
        <li><a href="#sites-not-listed">What about sites which are not listed?</a></li>
      </ul>

      <h3>Bug reporting</h3>
      <ul>
        <li><a href="#what-next">Once I have found a vulnerability,
          what next?</a></li>
        <li><a href="#nondisclosure">If I report the bug directly to you,
          do I have to keep the bug confidential and not publish information
          about it in order to receive a reward?</a></li>
        <li><a href="#cooperation">I don’t have the time or desire to work
          with you further in investigating and fixing the bug; can I still get a
          bug bounty reward?</a></li>
      </ul>

      <h2>General questions</h2>
      <dl class="faq">
        <dt class="question" id="why">Why do we include web applications
          as part of our security Bug Bounty Program?</dt>
        <dd class="answer">
          <p>Mozilla client software relies on web services, and Mozilla’s community uses
          websites and services to communicate and coordinate activity.
          Our goal is to make our products and services more secure.
          Mozilla community members submitted bugs before we had an official bounty program
          to reward researchers. The bounty program is designed to incentivize bug reporting towards the websites,
          services, and types of bugs we’d like community members to focus on.</p>
        </dd>

        <dt class="question" id="howto">How can I find potential vulnerabilities
          and are there things I shouldn’t do in trying to find them?</dt>
        <dd class="answer">
          <p>We have received many questions around how to find web application
            security issues. The most common concern is the use of automatic tools.
            We ask that people don’t use automatic tools against our web services
            as it is important to maintain our services and availability. We do
            encourage people to examine typical areas for vulnerabilities such as
            authentication and session management. Since our code is open source, you are
            encourage to run on the software on your own server instance or just look
            at the source code for potential issues.</p>
            <p>On Mozilla’s Wiki, you can find information about some of our
              <a href="https://wiki.mozilla.org/Security/TestingToolchains/">security testing toolchains.</a></p>
            <p>See the list below for the domains and applications which are in scope.</p>
        </dd>

        <dt class="question" id="bounty-amount">Is the amount of the bounty
          different for web applications vulnerabilities?</dt>
        <dd class="answer">
          <p>Payments vary according to the severity of the issue, with the range
            starting at $500 (US) for moderate severity and up to $3000 (US) for
            High or Critical vulnerabilities.</p>
        </dd>

        <dt class="question" id="severity-ratings">Is there a list of severity
          ratings with examples?</dt>
        <dd class="answer">
          <p>Yes, here it is:
            <a href="https://wiki.mozilla.org/WebAppSec/Web_App_Severity_Ratings">
              Web Application Severity Ratings</a></p>
              The bounty committee’s reward is based on the security and privacy
              impact of the bug and ultimately the importance of the website or service.
        </dd>
      </dl>

      <h2>Eligible bugs</h2>
      <dl class="faq">
        <dt class="question" id="eligible-bugs">Which domains and web applications
          will be considered to be part of the bug bounty?</dt>
        <dd class="answer">
          <p>Below is the list of domains eligible for Mozilla’s website and services
            security bug bounty. Please check it regularly, as it changes over time.</p>

          <h4>www.mozilla.com/org</h4>
          <ul>
          	<li>www.mozilla.com</li>
          	<li>www.mozilla.org</li>
          	<li>www.firefox.com</li>
          	<li>www.getfirefox.com</li>
          </ul>

          <h4>ABSearch</h4>
          <ul>
          	<li>Search.services.mozilla.com</li>
          </ul>

          <h4>Addons.mozilla.org</h4>
          <ul>
          	<li>addon.mozilla.org</li>
          	<li>addons.mozilla.org</li>
          	<li>blocklist.addons.mozilla.org</li>
          	<li>builder.addons.mozilla.org</li>
          	<li>services.addons.mozilla.org</li>
          	<li>static.addons.mozilla.net</li>
          	<li>versioncheck-bg.addons.mozilla.org</li>
          	<li>Versioncheck.addons.mozilla.org</li>
          </ul>

          <h4>bugzilla.mozilla.org</h4>
          <p>
            <strong>Please don’t use automated scanners and create bugs for testing on the production instance.</strong>
            Install your own local copy for testing from
            <a href="https://github.com/mozilla/webtools-bmo-bugzilla">https://github.com/mozilla/webtools-bmo-bugzilla</a>.
          </p>
          <ul>
          	<li>bugzilla.mozilla.org</li>
          </ul>

          <h4>Product Delivery</h4>
          <ul>
          	<li>download-installer.cdn.mozilla.net</li>
          	<li>Download.mozilla.org</li>
          </ul>

          <h4>AUS/Balrog</h4>
          <ul>
          	<li>aus3.mozilla.org</li>
          	<li>aus4.mozilla.org</li>
          	<li>aus5.mozilla.org</li>
          	<li>Aus.mozilla.org</li>
          </ul>

{'fraction_non_alphanumeric': 0.11867513255220266, 'fraction_numerical': 0.004451135694180795, 'mean_word_length': 2.2940922811556708, 'pattern_counts': {'":': 0, '<': 387, '<?xml version=': 0, '>': 387, 'https://': 8, 'lorem ipsum': 0, 'www.': 10, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7319776', 'n_tokens_mistral': 4527, 'n_tokens_neox': 4268, 'n_words': 1476}