Infomaniak Bug Bounty program

About us and our program

Us at Infomaniak

Infomaniak is Switzerland's largest web-hosting company, also offering live-streaming and video on demand services. Founded in 1994, Infomaniak is an independent company wholly owned by its founders and employees. Not only are 70% of their employees highly qualified engineers, they also focus systematically on internal development and open source solutions to design their products. Guaranteeing the security and confidentiality of the data entrusted to them is one of their priorities.

---

✅ Eligibility and Rules

Please adhere to the following rules while performing research on this program:

• Denial of service (DoS) attacks on our applications, servers, networks or infrastructure are strictly forbidden.
• Avoid tests that could cause degradation or interruption of our services.
• Do not use automated scanners or tools that generate large amount of network traffic.
• Do not leak, manipulate, or destroy any user data or files in any of our applications/servers.
• Do not copy any files from our applications/servers and disclose them.
• No vulnerability disclosure, full, partial or otherwise, is allowed.

Reward Eligibility and Amount

We are happy to thank everyone who submits valid reports which help us improve our security, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability (see below).
• The report must contain the following elements:
  • Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and our organisation, and remediation advice on fixing the vulnerability
  • Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact
  • Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc
• You must not break any of the testing policy rules listed above.
• You must not be a former or current employee of our organisation or one of its contractors.
• If you find the same vulnerability several times, please create only one report and eventually use comments. You'll be rewarded according to your findings.
• The triage team will use the "One Fix One Reward" process: if two or more endpoints/forms use the same code base and a single fix can be deployed to fix all the other weaknesses, only one endpoint will be considered as eligible for a reward and other reports will be closed as Informative/Duplicate.

Reward amounts are based on:

• Reward grid of the report's scope
• CVSS scoring and actual business impact of the vulnerability upon performing risk analysis

⚠️ Testing precautions

We ask that you conduct your bug bounty activities in a way that does not impact the experience of our clients or our operational teams. If you are interested in testing something that may be considered critical for production, we encourage you to contact us beforehand, and we will work with you to provide the necessary testing conditions.

🔎 Discovery Methodology

Your report must explain how you discovered the vulnerability, not just how to reproduce it. Crucially, please detail how you identified the vulnerable endpoint or asset (e.g., via directory fuzzing, client-side JavaScript analysis, exposed source code, or an external repository). This helps us validate the finding, understand our attack surface, and implement systemic fixes. Reports lacking discovery context may be delayed.

📧 Account and Support Management

For any client account creation necessary for your tests, *please use exclusively your YWH aliases (@yeswehack.ninja).**

• Don't create unnecessary accounts: Reuse your existing client accounts as much as possible to avoid polluting our database with fictitious profiles.
• Customer Support: Do not test contact systems like kChat or Mail support tickets intensively. These channels must remain available for our real clients.

🛡️ Traffic Identification

Your User-Agent header must be set to Infomaniak-YWH-Bugbounty for all your requests.
This allows us to clearly identify traffic from the bug bounty program. We reserve the right to block accounts or IP addresses violating these rules, especially in case of service quality impact or failure to follow identification guidelines.

TLDR;

• Use *@yeswehack.ninja aliases for creating any new client accounts needed for tests.
• Reuse your existing accounts as much as possible (avoid massive account creation).
• Do not abuse support channels (KChat, Mail).
• The User-Agent must imperatively be: Infomaniak-YWH-Bugbounty.
• Any violation of these rules may result in access blocking to the program.

---

Infomaniak’s Challenges winners

• Challenge #6 : Node.js Hosting > in progress... ⏳

• Challenge #5 : Managed Kubernetes service > in progress... ⏳

• Challenge #4 : Email Encryption via kSuite > Our challenge has been won by Zedfocing, congratulation 🎉🏆

• Challenge #3 : MyKSuite > Our challenge has been won by b0unc3, congratulation 🎉🏆

• Challenge #2 : Mobile and Desktop apps > Our challenge has been won by MrTuxracer, congratulation 🎉🏆

• Challenge #1 : Radio Streaming and Hosting Products 👋 😀 > Our challenge has been won by two winners ex-aequo Rabhi and Ertugrul, congratulation on nice vulnerabilities in our radio product !

Challenges

Challenge #6 : Node.js Hosting

We’ve just added our Node.js hosting platform to the scope of our bug bounty program — and we’re launching a dedicated challenge!

🧪 You can start testing right now with 30 days of free access:
👉 https://www.infomaniak.com/en/hosting/nodejs-hosting

📚 Not sure how to get started? Check out the documentation here:
👉 https://faq.infomaniak.com/2537

💰 Bonus reward: The first valid report on this new perimeter will receive a +50% bounty bonus.

This is a great opportunity to explore a new environment and make an impact. We’re counting on your insights.

We look forward to your findings.

Challenge #5 : Managed Kubernetes service

We are thrilled to announce the launch of our new product: Managed Kubernetes service ☸️ ! We invite all bug hunters to test this product here: https://www.infomaniak.com/en/hosting/public-cloud/kubernetes

It comes with a free trial offer, so you can use it to kickstart your testing !

Additionally, we are offering a 50% bonus for the first report submitted within this scope. So, don't hesitate to dive in and explore this exciting new product.

We eagerly await the results of your tests and are confident that your efforts will help us enhance our platform even further.

---

What we're looking for with this program

We are more than happy to be working with the YWH community to leverage its creativity and expertise in order to improve our products and assets' security. We try our best to provide secure solutions but as security is a constant struggle, we'd like your help in spotting anything that we might have missed !

We are particularly interested in any vulnerability involving the following :

• Leaking of personal data
• Horizontal / vertical privilege escalation
• SQLi
• Server misconfiguration
• Server-Side Request Forgery
• Insufficiently Protected Credentials
• Network misconfiguration (between customers and internal servers)

Our program is constantly evolving and our scope expanding, do keep an eye out for new targets to test !

Specific provisions and testing conditions

Public Links and Identifier-Based Access – Scope Exclusions

Please note that these are strictly out of scope and will be closed as RTFS without reward :

• High-Entropy Identifier Guessing: Vulnerabilities that rely on brute-forcing or predicting UUIDs, tokens, or other high-entropy identifiers used for public access links across services such as kDrive, SwissTransfer, Mail, invoicing PDF, tickets PDF, kPaste, etc.
• Public Access via Link: Access to resources without authentication when using a valid public sharing link. This behavior is considered by design, where the link itself acts as the credential.
• Complexity Barrier: Reports where successful exploitation requires prior knowledge of a target's UUID which is not easily guessable or exposed, adding a significant complexity barrier that mitigates the risk

Mobile and Desktop Applications – Scope Exclusions

Please note that these are strictly out of scope and will be closed as Informative or Not Applicable without reward:

• Local Access Requirements: Vulnerabilities in Infomaniak desktop applications that require the attacker to have local user access on the same machine.
• Third-Party Dependencies: Exploits that are only possible when a malicious third-party application is already installed by the victim.
• Unofficial Clients: Any issue that relies on the user installing or using an unofficial, modified, or malicious version of our mobile or desktop applications.

About Denial of service

Given our product and context, our customers expect the highest level of availability. Thus DoS/DDoS attacks or brute force attacks are not allowed and we ask you to avoid any test that might disturb our service and customer's servers.

In doubt, please reach out to the team at security@infomaniak.com

Openstack products are Out of scope

We use Openstack platform to provide instances, network, databases. You can create resources and find misconfigurations, unprotected data, etc.
Vulnerabilities like XSS in Openstack dashboard (Horizon) are out of scopes.

Vulnerabilities on Ticketing service

We allow our customers to inject JavaScript and html code into certain parts of the online ticketting service shop so that they can add google tag tracking for instance, or external content. This is of course an intended behavior even though it could allow them to inject an XSS payload for example.

Thus, we won’t accept and consider for reward reports linked to vulnerabilities introduced through the ticketing service editor, or another ticketing page/feature by an administrator/technical/sales users that are targeting their own website’s users.

Vulnerabilities on Page editor and site creator

In order to allow full customization of their websites Customers with administrator rights can edit or create pages with Page editor or Site creator and are allowed to inject JavaScript or html code for instance. This is of course an intended behavior even though it could allow them to inject an XSS payload for example.

Thus, we won’t accept and consider for reward reports linked to vulnerabilities introduced through Page editor or Site creator by a website administrator that are targeting their own website’s users.

HTML Injection in emails

These vulnerabilities are not currently of interest to the company and have been temporarily excluded. We are planning to change our templating system.

Business logic

We do not verify users' emails because we aim to provide a free and seamless user experience. Infomaniak offers a kCheck application and feature that can verify user identities in cases where we observe disruptive behavior. This helps us identify and block suspicious users.

Business logic Errors

Vulnerabilities of the 'Business Logic Error' type are not considered within the scope of this bug bounty program. Only serious cases involving leaks of personally identifiable information (PII) or leaks of customer or confidential data will be considered eligible for a reward. Bugs related to user rights on a product, between different products, or to restricted functionality limitations of a product will not be taken into account.

Broken Access Control

Broken Access Control vulnerabilities linked to inconsistencies in rights between administrators, employees or external users are no longer considered within the scope of the programme. Only critical cases involving leaks of information and significant personal data. Or a major impact on the business or financial aspects of our products.

kMeet

The program excludes vulnerabilities inherent to third-party platforms. Features such as ANONYMOUS SASL authentication, allowing unauthenticated XMPP connections, are considered standard functionality for public services. Exposed client-side configuration and public API keys are intended by design. Such behaviors are only in scope if they demonstrate unauthorized access to private resources or critical Infomaniak-managed interfaces.

Note regarding AI vulnerabilities

Specific in scope vulnerabilities for AI scope

In addition to the usual vulnerabilities we're also looking for any flaw that might lead to exploits specific to AI models, i.e. :

• Influencing and changing the AI model in ways that impact other users
• Ability to perturb valid inputs such that the model produces incorrect outputs for other users
• Circumventing history protections and history deletion mechanisms to access other users' history
• Ability to poison the AI model or its data by tampering with its architecture, training code/data or hyperparameters

Out of scope vulnerabilities for AI scope

In the framework of this program, we're not interested in behaviors that do not pose a direct security concern or that could be considered as an output quality/accuracy issue, i.e. :

• AI Command/Prompt Injection attacks that only affect the attacker or generate content that is shown only to the attacker
• Model Hallucination attacks, e.g. AI model disclosing falsely confidential data or pretending to run code provided by an attacker
• Outputs that could be considered as safety issues, that seem inaccurate or offensive
• Accessing/revealing the AI model's internal workings and prompts without revealing sensitive or security related information

Out of scope services

The following services are out of the scope of this program :

• Housing
• Very high availability Hosting
• Synology
• Jelastic cloud
• Debian community servers : example with buster-.infomaniak.ch, bookworm-.infomaniak.ch

Site creator scope

We provide Site Creator instances for hunters to test:

https://5k8vrbdyje.infomaniak.site
https://tb7pxbdyjg.infomaniak.site
https://fv3lfbdyjh.infomaniak.site
https://l75pvbdyjo.infomaniak.site

Our customers' site creators are not part of the programme and we ask you not to test them.

Mobile and desktop applications

Android kDrive https://github.com/Infomaniak/android-kDrive
Android kMail https://github.com/Infomaniak/android-kMail

iOS kDrive https://github.com/Infomaniak/ios-kDrive
iOS kMail https://github.com/Infomaniak/ios-kMail

Desktop kDrive https://github.com/Infomaniak/desktop-kDrive

Reports of leaks and exposed credentials

We are open to some types of reports related to exposed secrets, credentials or information.
Please pay attention to our list of Qualifying/Non-Qualifying vulnerabilities, as well as our Scope and the following rules.

In order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behavior (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees/service providers

Disclosed information like credentials, emails, calendar invitation, guest invitation link, swisstransfer public link, kdrive public link, vod public, pdfs (invoicing, ticketing, etc) link from this sources are not accepted :

• archive.org
• wayback machine
• virusTotal
• google dorking
• urlscan.io

Eligible reports

Reports of exposed secrets, credentials and sensitive information will be considered eligible if it complies with the following:

• The source of exposure/leak is under our company’s control, directly or indirectly, e.g. stolen information or bundled information from a random source is not eligible.
• The exposed information has been verified (or tested) and confirmed

If you identify a source (under our control) that is leaking multiple data, we kindly ask you to report it in a single report and we will consider the impact based on the nature and depth of the exposed data.