Security bug bounty program
at Piwik PRO

To be eligible for a reward under this program, you must meet the following conditions:

• Keep in mind that any bugs not related to the Piwik PRO Analytics Suite platform (such as those concerning the piwik.pro website or connected consent management tools) fall outside the scope of this bug bounty program.
• Perform audit tests only using our Sandbox infrastructure on *.piwiksandbox.com – you can create a 30-day trial Business plan account using the form below. Please note that once your trial account expires, it will be deleted and you will need to create a new trial account if you wish to continue your research.
• Please test only accounts you own in *.piwiksandbox.com domain.
• This program covers vulnerabilities within the Piwik PRO Analytics Suite platform only. The piwik.pro website, all *.piwik.pro subdomains and customer instances, and any connected tools (such as consent management platforms) are explicitly excluded and will not be accepted.
• Do not perform any testing in our production environments, especially on trial accounts created using any form other than the one available below.
• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be qualified. See “How to report” below for detailed instructions on how to report a bug.
• Researchers may use AI tools to help prepare vulnerability reports. However, all submissions must be accurate, reproducible, and based on the researcher’s own findings. The submitting researcher is responsible for reviewing and validating all AI-generated content. If technically applicable PoC video that confirming finding is required. Reports containing inaccurate, fabricated, or low-quality AI-generated content may be closed or considered ineligible.
• Do not publicly disclose any details of the vulnerability, an indicator of vulnerability, or the content of the information rendered available by the vulnerability without explicit written authorization from Piwik PRO.
• To protect our customers, researchers must not approach, notify, or communicate with any customer or third party about suspected vulnerabilities at any stage of the disclosure process.
• The method used to detect vulnerabilities must not infringe on privacy, destroy data, or cause disruptions or a decline in the quality of our services.
• Anonymize all sensitive data gathered during an attack. Ensure you secure and delete it after reporting.
• To be eligible for a reward, the vulnerability you report must be previously unknown to us. This means it must not have already been identified internally, reported by another researcher, or currently tracked by our security team
• Reward is granted to the first valid report.
• If you report multiple vulnerabilities caused by one underlying issue, we will treat it as a single valid report.
• The Piwik PRO Security Team reserves the right to respond within 3 to 5 business days. In special cases, the triage process may take longer, and the reporter will be notified accordingly.
• Reports submitted in accordance with the program will not result in legal action. We will not report them to law enforcement if the reporters are acting in good faith.

If any of the above requirements are not fulfilled – your report will be rejected.

Please refrain from engaging in the following practices:

• Using automated tools for high-volume fuzzing / bruteforce scans – tests performed for the purpose of security research can’t have a negative impact on our infrastructure and platform. This kind of test might be treated as a DOS attack, and we may take action to block this type of traffic and prevent the situation from recurring. Only low-rate automated scanning is accepted (e.g. with Burp/OWASP ZAP or similar tools).
• Sharing information about vulnerabilities with people not authorized by Piwik PRO.
• Performing actions that may negatively affect the Piwik PRO company or the platform (for example, SPAM).
• Any physical attack on IT infrastructure and/or company personnel.
• Social engineering – such as phishing, fishing, or smishing on Piwik PRO staff and users.
• Exfiltrating data – tests should be performed on the minimum amount of data necessary to confirm the vulnerability.
• Violating any applicable laws or agreements to discover vulnerabilities.

The following issues fall outside the scope of our bug bounty program:

• Bugs not related to Analytics Suite, for example, bugs concerning the piwik.pro website or connected consent management tools, including Cookie Information consent management tool.
• Vulnerabilities affecting users of outdated or unsupported browsers or platforms.
• Cross-site scripting bugs that require an unusual amount of interaction or significant user engagement.
• Cross-site request forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
• Missing CAPTCHA.
• Password complexity or account recovery policies or methods? We had some cases with reports like “account cannot be recovered without email” despite policies being out of scope (just add methods word) 
• HTTPS Mixed Content.
• Issues without clearly identified security impact.
• Missing headers alone are out of scope, but exploitable misconfigurations are in scope.
• Invalid or missing SPF, DKIM, or DMARC records.
• Weak SSL/TLS Cipher Suites. Theoretical cryptographic weaknesses without exploit scenario
• Sending vulnerability reports using automated tools without validation.
• Use of a known-vulnerable library without evidence of exploitability unless a working exploit path is demonstrated.
• Attacks requiring physical access to an unlocked user device.
• Reports of SPAM, phishing, or security best practices.
• Software version disclosure / banner identification issues / descriptive error messages or headers (such as stack traces, application or server errors).
• Missing cookie flags on non-sensitive cookies.
• Users with superuser privileges posting arbitrary JavaScript (for example, via the Tag Manager module).
• Tabnabbing.
• Path disclosure.
• Vulnerabilities already known and reported by other security researchers.
• Stolen/Breached credentials.
• Missing rate limiting without demonstrated impact / exploitation
• Ability to enumerate users (e.g. via login, password reset) without additional impact
• Open redirects without demonstrated phishing or token leakage impact
• Clickjacking on non-sensitive pages
• Self-XSS or issues exploitable only by the reporting user
• Email spoofing without SPF/DKIM bypass or phishing vector
• Access to non-sensitive data without privilege escalation 
• Access to non-production or debug endpoints without sensitive data
• Cache poisoning or CDN issues without demonstrable impact
• Logs or debug info without sensitive data.

Contact us at bounty@piwik.pro with a description of the steps needed to reproduce the issue.

You are required to provide a detailed summary of the vulnerability, including the following pieces of information:

• Date and time when the vulnerability was detected.
• Vulnerability description.
• Type of the identified vulnerability.
• Affected URLs.
• Risk breakdown:
  • Risk – What can an attacker achieve?”
  • Difficulty to exploit.
  • CVSS3.0/3.1 base score (You can use the following calculator).
• Steps to reproduce.
• Video/Screenshots PoC.
  • Examples: account takeover PoC, data access example, etc.
• References.

Expected form of reports should contain the following issues. Report must demonstrate clear impact (e.g. bypass of billing, permissions, data isolation).

Title:
Summary:
Steps to reproduce:
Expected result:
Actual result:
Impact:
CVSS score:
Environment:
Attachments: