Security

Responsible disclosure & bug bounty policy

Should you discover a vulnerability in Stateside Proxies, we would be glad to hear of it. To avoid surprises on either side, this page lays out the scope, what we do and do not pay for, and how to report.

Scope

In scope

This website, statesideproxies.com
Its API, and the customer dashboard you sign in to
Handling of API keys, rotation links and proxy credentials inside the dashboard

Out of scope

Modem hosts and proxy gateways, along with the mobile carrier networks behind them
Services run by third parties: email providers, Cloudflare, Telegram, payment processors
Marketing assets served from legacy CDN paths
Customer accounts or data other than your own

What we pay

We reward demonstrated impact on our customers or our systems. Amounts are in USD.

Critical

$100 – $250

Remote code execution on our servers
SQL injection capable of reading or writing customer data
Entry to any account by defeating authentication, with no credentials held
Manipulating payments or balance to get proxies, credit or refunds without paying
Mass exposure of personal data or proxy credentials belonging to other customers

High

$50 – $100

Viewing or altering the proxies, orders or account details of another customer (IDOR)
Stored cross-site scripting that executes in the session of an admin or another customer
Privilege escalation that carries a customer account into admin functions
Server-side request forgery reaching internal services
Stealing the API key, rotation link or session of another account

Medium

$20 – $50

Account-state changes forced through cross-site request forgery
Reflected cross-site scripting that depends on the victim clicking a link
Bypassing rate limits in a way that leads to a demonstrated account takeover
Errors in pricing or business logic with a demonstrated financial impact

Low / Informational

Not paid, though we acknowledge them and fix them where warranted. Before writing the report, you can consult the full list below.

What we do not pay for

At most, these are accepted as Low or Informational. We read them and fix what merits fixing, yet they earn no bounty, and marking the report Critical or High does not change that.

Session tokens that keep working after logout, a password change or a password reset, until the token expires
Security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) that are missing or “weak”, without a working exploit
Clickjacking against pages with no sensitive action on them
Attributes of cookies other than session cookies
Enumeration of usernames or emails, timing and error-message routes included
Observations on login, forgot-password or rate limits with no account takeover demonstrated
Opinions on password policy: length, complexity, common-password lists, no forced rotation
Two-factor authentication that is missing or merely optional
Self-XSS and any XSS triggerable solely by the attacker in their own session
CSRF against login, logout, language or similar non-sensitive forms
Open redirects with no leak of a token or credential
Disclosure of software version, server banner, stack trace or path, with no sensitive data
SPF, DKIM or DMARC configuration reports
Output from a scanner, submitted with no accompanying proof of concept
Testing that places load on our systems, whether denial of service, brute force or resource exhaustion
Phishing or social engineering of our customers or staff; physical attacks
Issues in the third parties we rely on: Cloudflare, Telegram, payment processors, email providers
Library versions that are out of date, with no working exploit against our deployment
Attacks that depend on a rooted phone, a compromised device or a man-in-the-middle position
Duplicates of known issues, theoretical risks and best-practice recommendations

Rules of engagement

First valid report wins. Duplicates, and issues already on our list, fall outside what we pay for. A root cause earns one payment, whatever number of endpoints it affects.
Prove it, then stop. Access only your own accounts and data. Where a test would expose another person's data, report at the first proof and stop there: no pivoting, downloading or persistence.
Do not degrade the service. Do not load test, run automated fuzzing at volume, or aim tests at proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
Give us time. Hold publication until the issue is fixed and 30 days have gone by. Once a fix is live, we will let you know.
Severity is ours to set. Impact is rated against our own systems, with the Bugcrowd Vulnerability Rating Taxonomy as our reference. We set payment amounts at our discretion within the ranges above and pay by USDT or PayPal.

Safe harbour. Research that follows these rules is authorised. Good-faith testing within scope will not draw legal action from us, and we ask the same good faith in return: no extortion, no threats of disclosure, no “pay first, details later”.

How to report

Email [email protected] with the subject Security report. Give us the affected URL, precise reproduction steps, the account you tested with and a proof of concept. Expect acknowledgement within 5 business days and a severity decision within 10 business days.

Machine-readable contact details are at /.well-known/security.txt.

Send a report

Policy last updated 2026-11-08.