Vulnerability in your website

Vulnerability in your website

[Muhammad javad]

Hi team

I found a vulnerability in your website and want to disclose it to you.

Let me know if you have any active bug bounty program or is there any
compensation for reporting vulnerabilities?

Looking forward to hearing from you

Best regards
Usman

Re: Vulnerability in your website

[Jeffrey Walton]

On Mon, Feb 7, 2022 at 1:10 PM Muhammad javad via Bzip2-devel
<bzip2-devel@sourceware.org> wrote:
>
> I found a vulnerability in your website and want to disclose it to you.
>
> Let me know if you have any active bug bounty program or is there any
> compensation for reporting vulnerabilities?
>
> Looking forward to hearing from you

Sourceware hosts the Bzip2 site. You should be able to reach the
Adminstrative and Technical contacts via a WHOIS lookup. But it looks
like they fail to publish the required information (this is an ICANN
contractual requirement):

    $ whois sourceware.org | grep '@'
    Registrar Abuse Contact Email: registrar-abuse@google.com

And I don't think registrar-abuse@google.com is who you want to contact.

I also can't find a security contact while searching the sourceware
site. Confer, https://www.sourceware.org/ and
https://www.google.com/search?q=security+contact+site:sourceware.org.

The page https://www.sourceware.org/suggestions.html offers
sourcemaster@sourceware.org. Maybe it will work (?).

Maybe try webmaster@sourceware.org, secure@sourceware.org or
security@sourceware.org? They may be conforming to RFC2142.

That's no way to run a railroad, as they say.

Jeff

Vulnerability in your website

[Muhammad javad]

Hi team

I found a vulnerability in your website and want to disclose it to you.

Let me know if you have any active bug bounty program or is there any
compensation for reporting vulnerabilities?

Looking forward to hearing from you

Best regards
Usman