Skip to content
Learn more about root-me.cloud
Log in

Vault ID (demo): Program guidelines

Introduction

Vault ID (demo) — Vault ID (demo) is a fictional identity provider: other apps hand their login over to it through OAuth, OIDC and SAML. This is fictional demonstration data; the .example domains are not real.

Program highlights

  • Open scopeReports on any asset the organization owns are considered, even when it is not listed in scope.
  • Full safe harborGood-faith research that follows the policy is authorized and protected.
  • Coordinated vulnerability disclosureFindings are made public only once fixed, in agreement with the reporter.
  • Cash rewardsEligible resolved reports earn a bounty within the ranges of the rewards table.
  • Managed by root-me.cloud
  • Collaboration enabled
  • Includes retesting
–Average time to first responseTarget: 2 days
–Average time to triageTarget: 5 days
–Average time to bountyNo data yet
–Average time to resolutionTarget: 3 months

Rewards summary

Reward range per severity for each bounty-eligible asset. Column headers show the average bounty paid and the share of resolved reports at that severity, when there is data.

AssetLowMediumHighCritical
id.vaultid.example$150 – $400$400 – $1,500$1,500 – $6,000$6,000 – $25,000
api.vaultid.example$150 – $400$400 – $1,500$1,500 – $6,000$6,000 – $25,000
*.vaultid.example$150 – $400$400 – $1,500$1,500 – $6,000$6,000 – $25,000
https://id.vaultid.example/.well-known/openid-configuration$150 – $400$400 – $1,500$1,500 – $6,000$6,000 – $25,000
admin.vaultid.example$150 – $400$400 – $1,500$1,500 – $6,000$6,000 – $25,000

Remember

  • Test only the assets listed in scope, with accounts you own or have explicit permission to use.
  • Stop as soon as you reach data that is not yours: take only what proves the issue, then report it.
  • No denial of service, spam, social engineering or physical attacks, and no changes that affect other users.
  • Keep findings confidential until they are disclosed through the platform, following the disclosure guidelines.

Scope exclusions

Findings in these categories are not eligible for this program.

CategoryExclusion details
Missing security headers

Reported without a working exploit that uses them.

Self-XSS

Where the victim has to attack their own session.

Login/logout CSRF and logout flaws

Unless they lead to account takeover or an access-control bypass.

Rate limiting

On endpoints where the lack of it has no realistic security impact.

Username or email enumeration

On its own, without an account-takeover chain built on it.

Session timeout length

Opinions on an idle-timeout value, with no concrete session flaw.

Password policy opinions

Complexity suggestions without a demonstrated weakness.

Denial of service

Not authorized against any asset.

Automated scanner output

With no demonstrated, manually-verified impact.

Third-party services

Report those to the vendor that operates them.

Policy

About this program

Vault ID (demo) is a fictional identity provider: other apps hand their login over to it through OAuth, OIDC and SAML. This is a fictional program used to demonstrate the platform — the domains use the reserved .example names, so there is nothing to actually test.

What we care about most

We run every asset on the Scope tab, but we are most interested in anything that lets someone sign in as another user, stay signed in when they should not, or reach data and features that are meant to sit behind the login or a paid entitlement. The whole product is authentication, so the login, consent, token-issuance and federation flows at id.vaultid.example are the entire point of this program.

Focus areas

In rough order of what we most want to hear about:

  • Authentication bypass and broken authentication — reaching an authenticated area, an admin view, or another tenant without valid credentials (CWE-287, CWE-306).
  • Account takeover — through the password-reset flow, the email- or phone-change flow, or a predictable or leaked credential (CWE-640, CWE-620).
  • Multi-factor authentication bypass — skipping, replaying or downgrading the second factor.
  • Session management flaws — fixation, sessions that never expire, tokens that survive a sign out or a password change, and predictable or improperly scoped session identifiers (CWE-384, CWE-613).
  • SSO and federation misconfiguration — OAuth, OIDC and SAML flows that can be redirected, replayed, or made to accept a token they should reject (CWE-287, CWE-347).
  • Broken access control and IDOR — missing authorization checks that expose or change another user's objects by changing an identifier (CWE-639, CWE-862).
  • Privilege escalation — moving from a normal account to staff or admin, or across tenants, horizontally or vertically (CWE-269).
  • Entitlement bypass — reaching premium, paid or tenant-restricted content without the entitlement that should gate it.
  • Token validation flaws — JWTs or API tokens accepted with a weak signature, a wrong audience or no expiry (CWE-345, CWE-347).

Rules of engagement

  • Test only against accounts you create yourself. Never use another person's account.
  • Prove impact with the smallest possible proof of concept. Do not read, change, export or keep another user's data; a single record or a screenshot of your own two test accounts is enough.
  • The moment a flaw gives you access to real personal data or someone else's account, stop and report it — do not explore further.
  • No denial of service, no automated load or scanning that degrades the service, no social engineering of staff or users, and no physical attacks.
  • Keep findings private until we have fixed them and agreed on disclosure.

Out of scope and ineligible

The exact systems you may test are on the Scope tab; only assets marked in scope are authorized. Reports that only restate an item on the Scope exclusions table, or that show no realistic security impact, are closed as Not applicable.

Recognition

Valid reports earn a bounty by severity (see the Rewards table) plus reputation and a public thank-you on the Thanks tab. Authentication and access-control issues that we can confirm are rated on their real impact — an account takeover or a full access-control bypass is treated as high or critical.

Coordinated disclosure

Once a report is resolved, either side can request disclosure; the other agrees, and we publish a summary (or the full report) by mutual agreement. This program follows the platform's disclosure guidelines.

Rewards

SeverityRewards
Low$150 – $400
Medium$400 – $1,500
High$1,500 – $6,000
Critical$6,000 – $25,000

Stats

Total bounties paid
$0
Average bounty
–
Top bounty range
$6,000 – $25,000
Reports received | 90 days
0
Last report resolved
–
Reports resolved
0
Hackers thanked
0
Assets in scope
5