Security
Responsible disclosure & bug bounty policy
If Real US Proxies has a vulnerability and you find it, please tell us. To avoid surprises for both sides, this page lists the scope, what is paid, what is not paid, and how to report.
Scope
In scope
- This website,
realusproxies.com - The customer login dashboard and its API
- How the dashboard handles API keys, rotation links and proxy credentials
Out of scope
- Mobile carrier networks, and the modem hosts and proxy gateways in front of them
- Services run by third parties: Cloudflare, email providers, payment processors, Telegram
- Marketing assets served from legacy CDN paths
- Any customer data or account that belongs to someone else
What we pay
We pay rewards for demonstrated impact on our customers or our systems. Amounts are in USD.
Critical
$100 – $250
- Remote code execution on our servers
- Reading or writing customer data through SQL injection
- Getting past authentication into any account without that account's credentials
- Manipulating a payment or balance to get proxies, credit or refunds without paying
- Personal data or proxy credentials of other customers exposed in bulk
High
$50 – $100
- IDOR that lets you read or change another customer's account details, orders or proxies
- Stored cross-site scripting that executes in the session of an admin or another customer
- A customer account that reaches admin functions through privilege escalation
- Server-side request forgery reaching internal services
- Stealing the session, rotation link or API key of another account
Medium
$20 – $50
- Cross-site request forgery against an action that changes the state of an account
- Reflected cross-site scripting where the victim must click a link
- Bypassing a rate limit, with a demonstrated account takeover as the result
- Errors in price or business logic, with a money loss you can show
Low / Informational
$0
No payment, but we acknowledge it and fix it where warranted. You can check the full list below before you write your report.
What we do not pay for
We rate these Low or Informational, and never higher. We read these and fix what is worth fixing, yet we issue no bounty, even if the report carries a Critical or High label.
- A session still valid after logout, a password change or a password reset, until its session token expires
- Security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) that are absent or “weak”, without a working exploit
- Clickjacking on a page with no sensitive action on it
- Attributes of cookies other than session cookies
- Enumeration of usernames or emails, also by timing or by error messages
- Observations on login, forgot-password or rate limits, without a demonstrated account takeover
- Opinions on password policy: complexity, length, no forced rotation, common-password lists
- Missing two-factor authentication (2FA), or 2FA that is only optional
- XSS that only the attacker can trigger in their own session, or self-XSS
- CSRF against non-sensitive forms such as login, logout or language
- Open redirects with no token or credential leak
- Disclosure of a path, stack trace, server banner or software version, without sensitive data
- SPF, DKIM or DMARC configuration reports
- Automated scanner results without a proof of concept
- Brute force, denial of service, resource exhaustion or any test that generates load
- Physical attacks; phishing or social engineering against our customers or staff
- Problems in the third-party services we use: email providers, Cloudflare, Telegram, payment processors
- An old library version, if you have no working exploit for our deployment
- Attacks needing a rooted phone, a man-in-the-middle position or a compromised device
- Duplicates of known issues, theoretical risks and best-practice suggestions
Rules of engagement
- First valid report wins. A duplicate gets no payment, and neither does an issue we already know. A root cause is paid once, no matter how many endpoints it affects.
- Prove it, then stop. Access only your own accounts and data. When a test would reveal another person's data, stop at the first proof and report it; no pivoting, downloading or persistence.
- Do not degrade the service. Do not load test, do not run automated fuzzing at volume, and do not test proxy gateways, modem hosts or carrier networks. Those are out of scope entirely.
- Give us time. Wait to publish until we have fixed the issue and 30 days have gone by. Once a fix is live, we will let you know.
- Severity is ours to set. Our reference for rating impact on our own systems is the Bugcrowd Vulnerability Rating Taxonomy. We decide each amount at our discretion within the ranges above, and we pay by USDT or PayPal.
Safe harbour. Research that follows these rules is authorised. Good-faith testing within scope will not bring legal action from us, and we ask for the same good faith in return: no extortion, no threats of disclosure, no “pay first, details later”.
How to report
Email [email protected] with the subject Security report. Send a proof of concept, the account you used, the affected URL and the exact steps to reproduce. Expect our acknowledgement within 5 business days and our severity decision within 10 business days.
Machine-readable contact details are at /.well-known/security.txt.
Send a reportPolicy last updated 2026-11-08.