Bug Bounty
Money in exchange for security. Legal and anonymous.
You find it, we pay. Up to $3,000, no fuss and no waiting.
Rewards
-
Low
Bugs not related to security: typos, broken links, layout glitches, and other small things.
$0–50 -
Medium
CSRF on important actions, reflected XSS, leaks of internal information, and similar issues.
$50–300 -
High
Stored XSS, IDOR with access to other clients' data, SQL injection, reading local files (LFI, XXE), SSRF, privilege escalation, and other issues of this level.
$300–1,000 -
Critical
Remote code execution (RCE), authentication bypass, account takeover, access to other people's servers or balance. The list isn't limited to these.
$1,000–3,000
We pay to your account balance, in crypto or by bank transfer. The amount depends on severity. Only the first person to report an issue gets the reward.
What to test
- my.h2.nexus
- Client area
- vm.h2.nexus
- Server control panel
- vm-promo.h2.nexus
- Promo server control panel
- dci.h2.nexus
- Dedicated server control panel
- @rdpbot
- Rent Windows servers right in Telegram
- @bgp_robot
- Create and manage BGP sessions
Rules
- Test on your own accounts.
- Don't touch other people's data beyond what the PoC needs.
- No DoS or DDoS.
- Send a working PoC, not scanner output.
- Don't publish the issue until it's fixed.
How to report
Write to us wherever it suits you, and we'll get back to you!
- root@h2.nexus
- Telegram
- @h2nexus_support
- Client area
- Ticket in my.h2.nexus