Bug Bounty Responsible disclosure and recognition

ForenShield provides a structured channel to report discovered vulnerabilities. Goal: fix issues quickly, improve resilience, and recognize the community's contribution.

Responsible disclosure means mutual respect, confidentiality and cooperation on mitigation. Until the full financial program launches (planned for 2027), symbolic or public recognition may be granted depending on impact.

In scope

• Official domains: forenshield.com and subdomains.
• Documented public UI and APIs.
• Explicitly testable demo/sandbox environments.

Out of scope

• DoS/DDoS, intentional denial of service.
• Social engineering (employees/customers/partners).
• Access to third parties, physical systems, or unlisted infrastructure.
• Tests exposing personal data outside a controlled setting.

Send your reports to security@forenshield.com with a clear description, reproduction steps (PoC), estimated impact and remediation ideas.

Subject: [BugBounty] <quick summary>

Hello,

Scope: https://forenshield.com/…
Type: (XSS / IDOR / SSRF / auth / …)
Impact: (What it actually allows)
Steps: 1) … 2) … 3) …
PoC: (minimal request / payload)
Mitigation: (fix idea if you have one)

Thanks.

Public recognition (with agreement), badges, Hall of Fame. Financial scale published with the full program in 2027. Severity, report quality and cooperation determine the recognition granted.

Data protection

Information submitted is processed in accordance with the GDPR and our Privacy Policy, solely to analyze and fix vulnerabilities.

Safe harbor (good faith)

Good-faith reports that comply with the scope and framework will not result in legal action. Confidentiality must be maintained until a fix is released.

Applicable law

French law. Amicable resolution is attempted before any legal action.