EncryptSecEncryptSec
Sign inCreate account
All programs

EncryptSec

Public

EncryptSec

Bug BountyWeb AppOWASP

EncryptSec is a cybersecurity company based in Kathmandu, Nepal, that provides penetration testing, managed security, and compliance services to global and local enterprises.

Core Services & Expertise…

Sign up to joinSign in

Rewards

USD 25 – USD 100

In scope

2 targets

Researchers

16

Launched

Sep 11, 2026

Reports accepted

8

12 received

Vulnerabilities rewarded

6

Average payout

USD 57

USD 75 paid

Median triage

0.1 days

Program brief

Welcome to the EncryptSec Bug Bounty Program

About EncryptSec :

EncryptSec is an enterprise cybersecurity company headquartered in Kathmandu, Nepal, serving clients across Nepal. We deliver OSCP-certified penetration testing & VAPT, Zero Trust architecture, 24/7 SOC / managed security, threat hunting, cloud security, compliance & auditing (ISO 27001, SOC 2, GDPR, NIS2), identity & access management, AI security, and OT/IoT security. Our team operates under an "assume breach" philosophy — and we apply the same adversarial rigor to our own infrastructure that we apply to our clients'.

Why this program exists :

We help organizations find vulnerabilities before adversaries do. We believe our own public-facing platform should withstand the same scrutiny — and we want the security research community's help proving it.

Rewards by severity

CriticalUSD 100
HighUSD 75
MediumUSD 50
LowUSD 25

Range: USD 25 – USD 100

In scope

  • platform.encryptsec.comWEB
  • encryptsec.comWEB

Out of scope

Not eligible

Testing restrictions (never test / never report):

Denial of Service (DoS/DDoS) vulnerabilities or any testing that degrades availability. Social engineering (phishing, vishing, smishing) and physical testing.

Any assets not listed as in-scope targets; findings from applications or systems not listed in the Targets section.

Functional, UI/UX bugs, and spelling mistakes.

Excluded submission types (marked invalid, not rewardable):

Descriptive error messages (stack traces, application or server errors).

HTTP 404 pages or other HTTP non-200 responses.

Fingerprinting / banner disclosure on common or public services.

Disclosure of known public files or directories (e.g. robots.txt, sitemap.xml).

Clickjacking and issues only exploitable through clickjacking.

CSRF on forms available to anonymous users (e.g. contact forms); logout CSRF.

Presence of browser autocomplete or "save password" functionality.

Lack of Secure/HttpOnly flags on non-sensitive cookies.

Weak or missing CAPTCHA, or CAPTCHA bypass without demonstrated account takeover impact.

Username / email enumeration via login or forgot-password error messages.

OPTIONS HTTP method enabled; verbose HTTP methods (PUT/DELETE/TRACE) without demonstrated impact.

Missing HTTP security headers: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, etc. (unless chained into a demonstrated exploit).

SSL/TLS issues: BEAST, BREACH, renegotiation attacks, lack of forward secrecy, weak/insecure cipher suites, expired/self-signed certificates on staging only.

Self-XSS, XSS requiring impossible user interaction, or XSS in sandboxed domains without sensitive impact.

Open redirects without a demonstrated high-impact chain (e.g. token theft).

CSV/formula injection without demonstrated exfiltration. Known-vulnerable third-party libraries without a demonstrated exploit path in our application.

Rate limiting / brute-force protections on non-sensitive endpoints, missing account lockout (unless leading to account takeover). Content spoofing, text injection, and missing security speed bumps.

Vulnerabilities in third-party services (CDN, payment processors, email providers); report them to the vendor directly. Previously known or already-reported issues (duplicates).

Nothing is explicitly excluded — read the program rules before testing.

Program rules

  1. Submit one vulnerability per report do not combine unrelated issues.
  2. Provide clear reproduction steps, affected URL/endpoint, and proof of impact.
  3. No DoS/DDoS, brute force, or resource exhaustion attacks.
  4. No social engineering or phishing of staff, employees, or users.
  5. No test accounts are provided — self-register your own accounts and never access or modify other users' data.
  6. Rate-limit automated scanning; keep request rates low enough to avoid service disruption.
  7. Test only assets listed as in scope; all others are strictly prohibited.
  8. Do not exploit a vulnerability beyond the minimum required to demonstrate impact.
  9. No public disclosure before the issue is resolved and you have our written approval (90-day embargo).
  10. Do not access or exfiltrate data; report exposure immediately without storing or sharing it.
  11. Duplicates, out-of-scope findings, and issues without demonstrated impact are not eligible for rewards.
  12. Respect any stop-testing requests issued by the program team.

Disclosure policy

Researchers who act in good faith, follow the program rules, and remain within scope will not be pursued legally by EncryptSec. We consider good-faith security research authorized activity.

Coordinated disclosure:

  1. Do not publicly disclose any vulnerability until it has been fixed and you have received our written approval.
  2. We ask for a minimum 90-day embargo from the date of your report.
  3. We aim to acknowledge reports within 2 business days and complete triage within 5 business days.
  4. If you believe a vulnerability is being actively exploited, contact us immediately via the primary contact and we will prioritize remediation.
  5. Do not access, exfiltrate, or retain user data. If you encounter it accidentally, stop, do not save or share it, and report it immediately.

Ready to hunt on EncryptSec ?

Create a free researcher account to join this program and submit findings.

Create account