Security

Responsible disclosure & bug bounty policy

When you find a vulnerability in SimProxies, we want to hear about it. This page defines the scope, what we pay for and what we do not, and the way to report, leaving no surprises on either side.

Scope

In scope

This website, simproxies.com
The customer dashboard you sign in to, as well as its API
Rotation links and API keys, plus proxy credential handling, inside the dashboard

Out of scope

Modem hosts and proxy gateways, plus the mobile carrier networks behind them
Services operated by third parties: payment processors, Telegram, Cloudflare, email providers
Marketing assets served from legacy CDN paths
Any account or data held by another customer

What we pay

We pay rewards for impact that is demonstrated on our systems or customers. Amounts are in USD.

Critical

$100 – $250

Remote code execution on our servers
An SQL injection that reads from or writes to customer data
Entering any account without its credentials through bypassed authentication
Payment or balance manipulation — receiving proxies, credit or refunds without paying for them
Bulk exposure affecting other customers' personal data or proxy credentials

High

$50 – $100

Another customer's proxies, orders or account details being read or changed (IDOR)
Stored cross-site scripting which runs in an admin's session or in another customer's
Privilege escalation out of a customer account into admin functions
Server-side request forgery reaching internal services
Stealing an API key, rotation link or session from another account

Medium

$20 – $50

Cross-site request forgery targeting a state-changing account action
A reflected cross-site scripting flaw that needs the victim to click a link
Rate-limit bypass leading to an account takeover that you demonstrate
Pricing or business-logic bugs with a financial impact you demonstrate

Low / Informational

Acknowledged, and fixed where warranted, with no payout. To check before you write the report, use the full list below.

Rules of engagement

First valid report wins. A duplicate, or a report of an issue we already know about, earns no payment. Only one payment is made per root cause, even if it affects many endpoints.
Prove it, then stop. Access only your own accounts and data. If someone else's data would be exposed by a test, stop at the first proof and report it, with no pivoting, downloading or persisting.
Do not degrade the service. You may not load test, fuzz automatically at volume, or test against proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
Give us time. Publication must wait for two things: our fix and 30 days passing. We will update you when a fix is live.
Severity is ours to set. Ratings reflect impact on our own systems, measured against the Bugcrowd Vulnerability Rating Taxonomy as the reference. Each payment amount falls within the ranges above at our discretion and is paid by PayPal or USDT.

Safe harbour. Research that follows these rules is authorised. We will not pursue legal action against you for testing in good faith within scope, and we ask that the same good faith flow back to us: no extortion, no threats of disclosure, no “pay first, details later”.

What we do not pay for

Accepted reports of this kind are Low or Informational at most. We will read them and fix anything worth fixing, though no bounty follows, and labeling a report Critical or High does not change that.

A session that is still accepted after logout or a password reset or change, until its token expires
Missing security headers or “weak” ones (CSP, HSTS, X-Frame-Options, Referrer-Policy) absent a working exploit
Clickjacking a page that contains no sensitive action
Attributes on cookies outside of session cookies
Username or email enumeration of any kind, timing and error messages included
Any forgot-password, login or rate-limit observation not backed by a demonstrated account takeover
Opinions about password length, complexity, common-password lists or the lack of forced rotation
No two-factor authentication, or 2FA available but not required
Self-XSS or XSS confined to the attacker triggering it in their own session
CSRF against the login, logout or language form or another non-sensitive form
Open redirects without any token or credential leak
Software version, server banner, stack trace or path disclosure that carries no sensitive data
SPF, DKIM or DMARC configuration reports
Output from an automated scanner, without a proof of concept
Denial of service, brute force, resource exhaustion or any test that produces load
Social engineering or phishing directed at our staff or customers; attacks that are physical
Problems that sit with third parties we use: payment processors, Telegram, Cloudflare, email providers
Library versions that are out of date, without a working exploit against our deployment
Attacks with a prerequisite of a compromised device, a rooted phone or a man-in-the-middle position
Recommendations about best practice, risks that are theoretical, and duplicates of known issues

How to report

Email [email protected] with the subject Security report. State the affected URL, the exact steps to reproduce and the account you used, and attach a proof of concept. Within 5 business days you get our acknowledgment, and within 10 business days our severity decision.

Machine-readable contact details are at /.well-known/security.txt.

Send a report

Policy last updated 2026-10-10.