Alasco GmbH - Bug Bounty Program

About Alasco GmbH

Alasco offers state of the art software for financial controlling and ESG management.
Security is very important to us and this Bug Bounty program shall help us meet highest industry standards to offer the most secure service and experience to all parties.

Program Rules

Attention: Business Continuity and Testing Conduct

Maintaining uninterrupted service for our users and partners is absolutely critical. All security testing must be performed with extreme care to avoid any form of business disruption. This includes actions that could degrade performance, interrupt service availability, or affect real customers.

Researchers are expected to act responsibly at all times and prioritize the stability, integrity, and security of Alasco systems above all else. If in doubt, stop testing immediately and seek clarification through the platform’s report discussion thread before proceeding.

Testing Policy and Responsible Disclosure

The below two rule sets form the core foundation of the Alasco Vulnerability Reward Program.

They are designed to protect business continuity, user data, and testing integrity.

• Priority Zero Rules are global and non-negotiable. They apply to all testing activities across all targets and take precedence over any other instruction or rule.
• Target-specific Program Rules define additional, per-target constraints — such as testing windows, rate limits, allowed endpoints, or isolated environments — to ensure safe and controlled testing for specific systems.

All researchers must review and follow both rule sets before starting any testing.

Violating either may result in disqualification of reports, revocation of bounty eligibility, or, in severe cases, suspension or termination of the entire program if operational damage occurs.

Priority Zero Rules

Please adhere to the following rules while performing research on this program:

• Denial of service (DoS) attacks on Alasco GmbH applications, servers, networks, or infrastructure are strictly forbidden.
• Tests that could cause degradation or interruption of our services are strictly forbidden.
• Do not use automated scanners or tools that generate large amounts of network traffic, or use them in a very gentle way (maximum 1 request per second unless explicitly permitted otherwise).
• Do not leak, manipulate, destroy, download, copy, or exfiltrate any user data, company data, or files from our applications, servers, or systems.
• Do not alter real data under any circumstances.
• No vulnerability disclosure, full, partial, or otherwise, is allowed without explicit written consent from Alasco.
• Do not spam registration forms or any public-facing forms on our websites, including but not limited to https://www.alasco.de/explore/
• You must append the defined user-agent to all web-based requests.
• Use dummy/test accounts and clearly identifiable test data whenever possible.
• If Alasco’s Security Team requests that you pause or stop testing, you must comply immediately.
• If you are unsure whether an action is safe, stop testing and ask first via the report discussion thread.

Target-specific Program Rules

In addition to the Priority Zero Rules above, the following target-specific rules apply where communicated for a given scope:

• Test only during approved hours
  Limit all testing activities to 08:00–17:00 CET. Do not perform any scans, automation, or manual testing outside this time window unless you have explicit written approval.

• Do not disrupt our business
  Do not run automation, scans, or tests that could degrade performance, disrupt services, or impact real users. If your activity risks service stability, stop immediately.

• Avoid heavy automation
  Do not run parallelized or high-volume automated tooling unless you have prior written approval. Default behaviour should be manual or single-threaded, low-rate testing.

• No public disclosure without explicit written consent
  Do not share findings, screenshots, logs, or artifacts with third parties. Report exclusively through the designated vulnerability disclosure platform. Public disclosure of any vulnerability requires written consent from Alasco — no exceptions.

• No altering of real data
  Never change, download, or exfiltrate company data — even if you gain access to any.

• Use identifiable test data
  Use dummy/test accounts and data that can be distinguished from normal traffic and production data.

• Follow Security Team instructions immediately
  If Alasco’s Security Team requests that you pause or stop testing, comply at once. Their direction takes precedence to protect users and operations.

• If in doubt — stop and ask
  When unsure about impact, environment, or data, pause testing and ask in the report discussion thread before proceeding.

Reward Eligibility

We are happy to thank everyone who submits valid reports which help us improve the security of Alasco GmbH, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The same vulnerability in different scopes will only count as one vulnerability.
• The vulnerability must be a qualifying vulnerability.
• The report must contain the following elements:
  • Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users, and Alasco GmbH, and remediation advice on fixing the vulnerability.
  • Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact.
  • Complete steps with the necessary information to reproduce the exploit, including, if necessary, code snippets, payloads, commands, etc.
• You must not break any of the testing policy rules listed above.
• You must not be a former or current employee of Alasco GmbH or one of its contractors.

Reward Grid

Reward amounts are based on:

• Reward grid of the report's scope
• CVSS scoring and actual business impact of the vulnerability upon performing risk analysis
• Discretionary judgement of Alasco’s CISO