Kiln Web / Infra

Kiln Web / Infra

@kilnfi
Live

Maximum reward

$100,000

Severity

Max. Reward

Critical

$100,000

High

$8,000

Medium

$2,500

Low

$1,000

No deposit required

Findings submitted

14

Start date

30 Oct 2025

Please sign in as a researcher to join the bounty.

Log in
InstructionsScope

In scope

Kiln Web / Infra Scope

Severity

Min and Max Reward

Critical

Up to $100,000

High

Up to $8,000

Medium

Up to $2,500

Low

Up to $1,000

The following hostnames are included in the scope:

If you discover a vulnerability in any component that is not explicitly listed but poses a risk to user funds, user data, or the integrity of the system, you may submit it for consideration. The team will review such submissions on a case-by-case basis.

Severity examples and Reward rules:

  • Critical with Fund Loss

    • Bounty: 10% of the funds directly affected (up to a maximum of $100,000).
    • Major fund loss through any means.

  • Critical

    • Bounty: Up to $20,000.
    • Remote access to execute arbitrary code on the server, leading to full control of server operations.
    • SQL injection resulting in full database compromise, unauthorized data manipulation, or leakage.
    • Exploiting misconfigured IAM policies to gain unauthorized access to cloud infrastructure (e.g., virtual machines, storage buckets).

  • High

    • Significant broken authentication or session hijacking.
    • Privilege escalation affecting critical functionality.

  • Medium

    • Access control bypass.
    • Privilege escalation.
    • Reflective or stored XSS.
    • CSRF, open URL redirection, directory traversal.
    • Subdomain takeover of in-scope domains.

  • Low

    • Sensitive information leakage (excluding metrics).
    • Incorrect API access controls.

Duplicate reports will not be rewarded. If multiple researchers report the same issue, we will reward only the first valid submission based on the time of receipt. However, we encourage researchers to include detailed PoCs and exploitation scenarios to help distinguish their reports.

The aggregate, maximum amount of Payouts for Kiln Web / Infra Bounty program is $500,000. All Payout amounts will be calculated based on the order in which the submission was received. The Program will be updated as appropriate to provide updates on Payout eligibility and amounts.

Note: Actual reward amounts are determined at Kiln’s sole discretion. Factors influencing payout include quality of report, completeness, and the severity and exploitability of the vulnerability.

Out of scope

Out-of-Scope Targets

The following issues are considered out of scope for this program and will not be eligible for rewards. These exclusions include known issues, accepted risks, or areas not prioritized for this program:

  • Public Information and Configuration Details:

    • Disclosure of known public files or directories (e.g., robots.txt or .well-known directories).
    • Banner disclosures on public or common services.
    • DNSSEC, SPF, DKIM, and DMARC issues without exploitable impact.
    • Presence of open ports or standard services without a demonstrable security impact.

  • Web Security Headers and Client-Side Issues:

    • Missing or misconfigured browser security headers (e.g., HSTS, CSP).
    • Vulnerabilities related to browser behavior, such as cached pages being accessible after logout via the browser back button.
    • Clickjacking vulnerabilities (e.g., missing X-Frame-Options headers).
    • Cookie flags.

  • Authentication and Rate Limiting:

    • Brute-force or credential-stuffing attacks.
    • Lack of rate-limiting or velocity throttling for endpoints.
    • Denial-of-service attacks (application-level or network-level).

  • Forms and User Interactions:

    • CSRF on forms available to anonymous or unauthenticated users.
    • HTML injection unless demonstrable escalation to directly exploitable XSS is possible.
    • XSS or behaviors where the user can only attack themselves.

  • File Uploads and Attachments:

    • Malicious attachments or files that require manual intervention for exploitation.
    • File uploads without exploitable impact (e.g., uploads restricted to non-executable file types).

  • Low-Impact Information Disclosures:

    • Non-sensitive information disclosure (e.g., metrics, version numbers, or error messages without exploitable paths).
    • Social Engineering and User Behaviour:
    • Phishing or other social engineering techniques against Kiln employees or users.

Default Out of Scope:

Please refer to the docs for default out of scope guidelines