Security
Responsible disclosure & bug bounty policy
We want to hear about any vulnerability you find in Mobile Proxies USA. Here is what is in scope, what we pay for, what we do not pay for and how to report, so neither side gets a surprise.
Scope
In scope
- This website,
mobileproxiesusa.com - The customer dashboard your team signs in to, plus its API
- Handling of rotation links, API keys and proxy credentials in the dashboard
Out of scope
- The proxy gateways and modem hosts, along with the mobile carrier networks behind them
- Third parties' services: payment processors, Telegram, Cloudflare, email providers
- Marketing assets served from legacy CDN paths
- Accounts or data belonging to any other customer
What we pay
Demonstrated impact on our systems or our customers is what gets rewarded. Amounts are in USD.
Critical
$100 – $250
- Remote code execution on our servers
- SQL injection reaching customer data for read or write
- Bypassing authentication to get into any account without its credentials
- Altering a payment or balance to get proxies, credit or refunds without paying
- Exposing, in bulk, other customers' personal data or proxy credentials
High
$50 – $100
- Viewing or altering the proxies, orders or account details of another customer (IDOR)
- Stored cross-site scripting executing in an admin's or another customer's session
- Escalating privileges from a customer account to admin functions
- Server-side request forgery reaching internal services
- A stolen API key, rotation link or session from another account
Medium
$20 – $50
- Cross-site request forgery against an action that changes account state
- Reflected cross-site scripting that depends on the victim clicking a link
- A rate limit bypassed in a way that leads to a demonstrated account takeover
- Errors in pricing or business logic that show a demonstrated financial impact
Low / Informational
$0
We acknowledge these and fix them where warranted, without payment. Check the full list below before writing up a report.
Rules of engagement
- First valid report wins. Duplicates, and reports of issues already known to us, earn no payment. A root cause earns one payment, no matter how many endpoints it touches.
- Prove it, then stop. Access only your own accounts and data. If a test is going to expose someone else's data, stop at the first proof and report it, with no pivoting, downloading or persistence.
- Do not degrade the service. Load testing and automated fuzzing at volume are not allowed, and neither are tests against proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
- Give us time. Hold publication until the issue is fixed and 30 days have passed. You will get word from us once a fix is live.
- Severity is ours to set. Impact gets rated on our own systems, and the Bugcrowd Vulnerability Rating Taxonomy is our reference. We set each payment at our discretion within the ranges above and pay by PayPal or USDT.
Safe harbour. Research that follows these rules is authorised. Good-faith testing within scope will not bring legal action from us, and we ask the same good faith from you: no extortion, no threats of disclosure, no “pay first, details later”.
What we do not pay for
We accept these at Low or Informational at most. We read them and fix what is worth fixing, but they earn no bounty, and labelling the report Critical or High does not change that.
- A session still active after a password reset, password change or logout, up to the session token's expiry
- Security headers missing or “weak” (CSP, HSTS, X-Frame-Options, Referrer-Policy) with no working exploit
- Clickjacking on pages with no sensitive action to hijack
- Attributes set on cookies other than session cookies
- Enumerating emails or usernames, including through timing or error messages
- Observations about forgot-password, login or rate limits with no demonstrated account takeover
- Password policy views: length, complexity, common-password lists, no forced rotation
- Two-factor authentication being absent, or 2FA only optional
- Self-XSS, or XSS an attacker can only trigger inside their own session
- CSRF against login, logout, language or other non-sensitive forms
- Open redirects with no token or credential leak
- A software version, server banner, stack trace or path being disclosed with no sensitive data
- SPF, DKIM or DMARC configuration reports
- Automated scanner reports that come with no proof of concept
- Brute force, denial of service, resource exhaustion or any test that generates load
- Phishing or social engineering against our staff or customers; physical attacks
- Issues in the third parties we rely on: payment processors, Telegram, Cloudflare, email providers
- Old library versions lacking a working exploit against our deployment
- Attacks only possible from a rooted phone, a compromised device or a man-in-the-middle position
- Best-practice recommendations and theoretical risks, plus duplicates of known issues
How to report
Email [email protected] with the subject Security report. Reports need the affected URL, exact steps to reproduce, the account used and a proof of concept. Expect our acknowledgement within 5 business days and a severity decision within 10 business days.
Machine-readable contact details are at /.well-known/security.txt.
Send a reportPolicy last updated 2026-11-08.