OS.University Smart Contracts are live — EDU token Bug Bounty reward awaits you!

Good News for Bug Hunters — OS.University Smart Contracts are Public!

Open Source University team believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you’ve found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly. Please send all security reports to security@os.university.

Disclosure Policy

Let us know as soon as possible upon discovery of a potential security issue, and we’ll make every effort to quickly resolve the issue. Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

Exclusions

While researching, we’d like to ask you to refrain from: Denial of service, spamming, social engineering (including phishing) of OS.University staff or contractors, any physical attempts against OS.University property or data centers.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Eligibility

The following requirements must be adhered to in order to participate in OS.University bug bounty program, and for any report to qualify. Not following these requirements can result in anywhere from your report being rejected, up to a ban from the program, depending on the severity.

1. Report format

For any report to be considered, you must provide clear instructions on how to reproduce the issue, as well as how it could be exploited (attack scenario), and (to the best of your knowledge) what is the security impact. This information helps us assess eligibility and appropriate bounty amounts.

2. First come, first served

Only the first person to identify a particular vulnerability will qualify for a bounty. Any reports submitted after that will be considered as duplicates and will not qualify.

3. Play it safe

All testing must be performed on test acconts under your control. Any attacks against other users without provable express consent is not allowed and may result in a ban from our program. If a particular issue is severe enough that a PoC in itself may expose other users’ data, please ask us for help first so we can work together on how to safely demonstrate the bug.

4. Don’t disclose early

To best protect our users, please keep all identified vulnerability details between you and us until we’ve had a chance to fix the issue. Public disclosure prior to us notifying you of the fix may result in a ban from the program. If you have any questions on remediation timeline, please inquire directly on the relevant report.

5. No social engineering

Bugs that require social engineering to exploit (e.g. tricking someone into clicking a link) may qualify, but please do not actually attempt to social engineer another user, any OS.Universtiy team member, etc. during your testing. Providing a clear explanation of how social engineering could be used in conjunction with an identified vulnerability is sufficient.

OS.University Smart Contract:

https://github.com/OpenSourceUniversity/EDUToken

Submit BUG here:

support@os.university

If you have any further questions, feel free to contact us the Bounty thread on BitcoinTalk.

---

[UPDATE] Bounty Campaign has been updated

---

Interested in OS University? Follow us!

Facebook | Twitter | Telegram | Bitcointalk.org | Reddit