generated: '2026-08-17' method: searched probe: true source: >- https://github.com/textmaster/bugbounty + https://raw.githubusercontent.com/textmaster/bugbounty/main/README.md + https://raw.githubusercontent.com/textmaster/bugbounty/main/SECURITY.md + https://raw.githubusercontent.com/textmaster/bugbounty/main/disclosure-guidelines.md checked: '2026-08-17' summary: >- TextMaster runs a real, paid, publicly documented bug bounty program — and runs it in an unusual place: a public GitHub repository, github.com/textmaster/bugbounty, using GitHub Security Advisories as the intake channel instead of HackerOne, Bugcrowd or Intigriti. Three policy documents are published (README, SECURITY.md, disclosure-guidelines.md), the maximum reward is $5,000, severity is scored with CVSS 3.0 by a published formula, and api.textmaster.com is explicitly named as in-scope "Core". This is a substantially more complete disclosure posture than most providers of this size publish. It is entirely invisible to machine discovery, because there is no /.well-known/security.txt on any host. program: exists: true paid: true kind: public bug bounty platform: GitHub Security Advisories (self-hosted, no third-party bounty platform) intake_url: https://github.com/textmaster/bugbounty/security/advisories intake_probed_status: 200 repository: https://github.com/textmaster/bugbounty repository_probed_status: 200 clarification_contact: bounty@textmaster.com submission_steps: - Go to https://github.com/textmaster/bugbounty - Click the Security tab - Click the Advisories sub-menu - Click "New draft security advisory" - Fill in the report following the published guidelines - Create the draft security advisory severity_calculator: GitHub built-in (CVSS 3.0 vector string) severity_caveat_from_provider: >- "Note that currently, GitHub does not support Temporal and Environmental scores. Therefore, your severity score might be lowered down after submitting your draft according to our policy." policy: - https://github.com/textmaster/bugbounty/blob/main/SECURITY.md - https://github.com/textmaster/bugbounty/blob/main/disclosure-guidelines.md - https://github.com/textmaster/bugbounty/blob/main/README.md contact: - bounty@textmaster.com - security_txt: null rewards: currency: USD maximum: 5000 maximum_condition: a critical vulnerability minimum: 100 scoring_standard: CVSS 3.0 (Base, Temporal and Environmental scores) formula: 'b = N x (C^n) where n = 3.0 and N = bmax / (Cmax)^n' published_table: - {cvss: 1, bounty: 100} - {cvss: 2, bounty: 100} - {cvss: 3, bounty: 135} - {cvss: 4, bounty: 320} - {cvss: 5, bounty: 625} - {cvss: 6, bounty: 1080} - {cvss: 7, bounty: 1715} - {cvss: 8, bounty: 2560} - {cvss: 9, bounty: 3645} - {cvss: 10, bounty: 5000} bonus_clause: >- "In rare cases, we may choose to accept and award a bonus for an issue with a CVSS score of 0 when we see a high potential for future security impact, and make a change as a result of the report." duplicate_fairness_clause: >- "Reward any report mistakenly closed as invalid if we later receive and reward the same bug reported by someone else. In these situations, we will reward both security researchers." And: "Pay the bounty difference to the duplicate reporter in case the new report demonstrates a higher CVSS score." scope: core: - {host: app.textmaster.com, env: Core, max_severity: Critical, reward_eligible: true} - {host: api.textmaster.com, env: Core, max_severity: Critical, reward_eligible: true} core_definition: '"TextMaster Core includes app.textmaster.com and api.textmaster.com."' api_in_scope: true api_in_scope_significance: >- The API host is named as first-class Core scope at Critical severity with full reward eligibility. That is a direct, provider-published statement that the API surface this repo catalogues is covered by the security program. non_core: - {host: textmaster.com, env: Non-core, max_severity: Medium, reward_eligible: false} - {host: '*.textmaster.com', env: Non-core, max_severity: Medium, reward_eligible: false} - {host: 3rd party apps, env: Non-core, max_severity: Low, reward_eligible: false} out_of_scope: - {host: docs.textmaster.com, reason: Operated by a third party} - {host: images.textmaster.com, reason: Operated by a third party} - {host: status.textmaster.com, reason: Operated by a third party} - host: storage-proxy.textmaster.com reason: >- "TextMaster allows clients to upload any file they want on our storage network. Being able to upload a file is not a vulnerability, this is the intended functionality." - {host: '*.subtitly.io', reason: null} - {host: '*.textmaster.co', reason: null} - {host: '*.textmaster.io', reason: null} - {host: '*.textmasters.com', reason: null} out_of_scope_note: >- Vulnerabilities on unlisted domains "will be accepted, but are ineligible for a reward." technology_in_scope: >- "All software components that are used within the TextMaster application may be exploited in your attack, including bugs in the Ruby interpreter (MRI), the Ruby on Rails framework, as well as third party libraries that we use (such as Ruby gems)." This also confirms the platform is a Ruby on Rails application. adjacent_property_note: >- The out-of-scope list names three sibling domains TextMaster owns or has owned — subtitly.io, textmaster.co and textmaster.io — plus a typo-defence entry (textmasters.com). subtitly.io is a subtitling product, which is a real product lead this profile does not otherwise capture. commitments: provider_pledges: - Reply to all reports - Be as transparent as possible, answering all inquiries about our report decisions - Award fair value bounties based on CVSS scores - Only close reports as Non Applicable when the issue is a listed Known or Ineligible Issue, or lacks evidence safe_harbor_stated: false safe_harbor_note: >- No explicit legal safe-harbour / authorized-testing clause was found. The guidelines set behavioural expectations (respect the rules, respect privacy, be patient, do no harm) but do not promise not to pursue researchers acting in good faith. disclosure_embargo: >- "Do not disclose any issues publicly before they have been resolved." No coordinated-disclosure deadline is stated. licensing_terms: >- Submitted content is licensed to TextMaster under the MIT License, and reporters "irrevocably waive all moral rights" in it. restrictions: - Not open to minors, individuals on sanctions lists, or residents of sanctioned countries - Commercial scanners are prohibited (e.g. Nessus) - Employees are excluded (they use an internal program) - 'Do not contact TextMaster support about the program; use bounty@textmaster.com' - Reports must be filed as soon as the vulnerability is validated known_issues_excluded: - Tab nabbing - Password reset tokens not expiring when changing email address - Reflected XSS requiring full control of an HTTP header (Referer, Host, etc.) - CSRF for login or logout, unless chained to demonstrate impact - CAPTCHA replay attacks ineligible_issue_classes: - Distributed Denial of Service - Content spoofing - Social engineering, including phishing - Email flooding - Unconfirmed reports from automated vulnerability scanners - Disclosure of server or software version numbers - Generic Host header attacks without evidence of a remote victim evidence: - source: https://github.com/textmaster/bugbounty kind: public repository status: 200 checked: '2026-08-17' - source: https://raw.githubusercontent.com/textmaster/bugbounty/main/README.md kind: program overview status: 200 bytes: 1997 checked: '2026-08-17' - source: https://raw.githubusercontent.com/textmaster/bugbounty/main/SECURITY.md kind: security policy (scope, rewards, rules) status: 200 bytes: 12015 checked: '2026-08-17' - source: https://raw.githubusercontent.com/textmaster/bugbounty/main/disclosure-guidelines.md kind: disclosure guidelines status: 200 checked: '2026-08-17' - source: https://github.com/textmaster/bugbounty/security/advisories kind: intake channel status: 200 checked: '2026-08-17' discoverability_gap: finding: >- The program is excellent and effectively undiscoverable by machine. There is no /.well-known/security.txt on api.textmaster.com, www.textmaster.com, fr.textmaster.com or docs.textmaster.com (32 probes, zero hits — see well-known/textmaster-well-known.yml), and no /security page on the marketing site (https://www.textmaster.com/security 301s to the homepage). A researcher or scanner has no path to bounty@textmaster.com except finding the GitHub org by hand. remediation_for_provider: >- Publish an RFC 9116 security.txt at https://api.textmaster.com/.well-known/security.txt with Contact: mailto:bounty@textmaster.com and Policy: https://github.com/textmaster/bugbounty/blob/main/SECURITY.md. This is a single static file and it would close the gap entirely. probed: - {url: 'https://api.textmaster.com/.well-known/security.txt', status: 404, checked: '2026-08-17'} - {url: 'https://www.textmaster.com/.well-known/security.txt', status: 403, checked: '2026-08-17'} - {url: 'https://www.textmaster.com/security', status: 301, redirects_to: 'https://www.textmaster.com/', checked: '2026-08-17'}