Merge pull request #4568 from gratipay/security-txt

Create a security txt.

www/security.txt

@@ -0,0 +1,44 @@
+# In scope targets
+In-scope: gratipay.com
+In-scope: grtp.co
+
+# Our GitHub projects
+In-scope: inside.gratipay.com
+In-scope: github.com/gratipay/bot
+In-scope: github.com/gratipay/environment.py
+In-scope: github.com/gratipay/postgres.py
+
+# Out of scope vulnerabilities
+Out-of-scope-vuln: Clickjacking
+Out-of-scope-vuln: Physical testing such as office access
+Out-of-scope-vuln: Social engineering
+Out-of-scope-vuln: UI and UX bugs and spelling mistakes
+Out-of-scope-vuln: Network level Denial of Service (DoS/DDoS) vulnerabilities
+Out-of-scope-vuln: Low severity issues that can be detected with tools such as Hardenize and SecurityHeaders.io
+Out-of-scope-vuln: Reports that state that software is out of date/vulnerable without a proof of concept
+Out-of-scope-vuln: Host header issues without an accompanying proof-of-concept demonstrating vulnerability
+Out-of-scope-vuln: XSS issues that affect only outdated browsers
+Out-of-scope-vuln: Stack traces that disclose information
+Out-of-scope-vuln: Highly speculative reports about theoretical damage
+Out-of-scope-vuln: Reports from automated web vulnerability scanners that have not been validated
+Out-of-scope-vuln: Content injection issues
+Out-of-scope-vuln: Cross-site Request Forgery (CSRF) with minimal security implications
+Out-of-scope-vuln: Missing cookie flags on non-security-sensitive cookies
+Out-of-scope-vuln: Banner grabbing issues
+Out-of-scope-vuln: Open ports without an accompanying proof-of-concept demonstrating vulnerability
+Out-of-scope-vuln: Recently disclosed 0day vulnerabilities
+Out-of-scope-vuln: Issues in third-party services
+
+# Rewards
+Reward: Critical-500
+Reward: High-100
+Reward: Medium-swag
+Reward: Low-hof
+Reward: None-hof
+
+# If you have any questions concerning our program, feel free to send us an email at [email protected]. 
+# Please do not send reports by email and make sure not to disclose sensitive information in the email.
+Contact: [email protected]
+
+# Our HackerOne program
+Platform: https://hackerone.com/gratipay