Report Security Issues
Last updated: October 2026
Have you found a weakness in moliser.com, the website of Moliser LLC? Please tell us. Serious reports all get read, confirmed problems get fixed, and qualifying reports get paid. You won’t need an account, a form or a bug-bounty platform. A single email reaches a person here.
Below are the ground rules, our promise not to go after anyone who keeps to them, the reward amounts, the exclusions and the way to reach us. Check the exclusions first, so you don’t put hours into a finding we can’t pay for.
Our promise to you
If you report a security issue in the way this page describes, we won’t take legal action against you over it, and we won’t ask the authorities to investigate you because of it. That protection is the reason for having this policy. Nobody should have to weigh the risk of a lawsuit against doing the right thing.
What we ask of you
- Give us time to investigate and release a fix before the issue is made public or shared with anyone else.
- Stay out of other people’s accounts. If an account isn’t yours, you need its owner’s explicit permission before you touch it.
- Take real care not to disrupt the service, destroy data or expose anyone’s private information while you test.
- Stop once you have proof. Showing that the flaw exists is the goal, and pulling out data you don’t need for that is not.
- Stay within the law the whole time.
Which reports qualify
Reward amounts are our decision. We weigh the severity, the potential harm and the quality of the write-up. In addition:
- The five points above must have been followed.
- The finding has to be a genuine vulnerability that puts a user’s privacy or the platform at real risk.
- Send it only to the email address given in the last section. Messages to individual employees don’t count.
- If your testing broke something by accident, say so. Telling us counts in your favor.
- We review every valid report. Serious issues go first, and a full answer can take some time.
- Once an issue is closed, we may publish a description of what was found.
How we set the reward
Include steps we can follow to reproduce the issue. A finding we can’t reproduce earns nothing, however interesting it may sound.
After that, three rules set the payment. Only the first person to report a valid issue is paid for it. Several bugs that share one underlying cause count as a single report. The amount itself depends on the damage the flaw could cause, the effort needed to exploit it and the quality of the report.
Reward tiers
| Severity | Maximum reward | Typical findings |
|---|---|---|
| Critical | Up to $200 | Remote code execution; a remote shell or command execution on our servers; SQL injection that exposes customer data; vertical privilege escalation past authentication; taking over someone’s account without permission |
| High | Up to $100 | Stored XSS; local file inclusion; session cookies set or handled insecurely; sensitive internal data exposed; horizontal privilege escalation between accounts |
| Medium | Up to $50 | Business logic flaws; IDOR (insecure direct object reference) |
| Low | Credit, no cash | Open redirects; reflected XSS; leaks of information with low sensitivity |
What sits outside the program
Some reports describe something real that still isn’t a vulnerability we can act on. These earn credit rather than a cash reward:
- output from an automated scanner, sent as it is, with nothing showing the issue can be exploited on our site;
- a security header that is missing but opens no real attack;
- bugs in software outside our control, our web host’s platform included;
- attempts to trick our employees, or anything that requires being physically on our premises;
- denial-of-service and other high-volume attacks, because flooding a site with traffic proves nothing about it.
If you aren’t sure which side of that line a finding falls on, send it anyway and explain your thinking. Asking first takes a minute. Guessing wrong can cost you days.
How to send a report
Write to contact@moliser.com. Describe the problem, list the steps that reproduce it and attach whatever backs it up, such as screenshots, a proof of concept or request logs. Someone on our team will read it and reply to you directly.