Vulnerability disclosure program

DataDome

datadome.co / public reporting path

Full+CVD5 signal

Write a scraper that beats the bot protection from a single IP. Configuration weaknesses and ordinary web bugs are explicitly not what this pays for.

Safe harbor

Good-faith testing inside the published scope is authorised.

Disclosure

First reply typically two to three days.

Intake

Policy intake

Scope rules

In scope

bounty-nodejs.datashield.co
bounty-fastly.datashield.co
bounty-nginx.datashield.co
js.datadome.co
api-js.datadome.co
*.captcha-delivery.com

This programme publishes no asset list, so everything under the primary domain is treated as in scope. Read the policy before you touch anything.

Out of scope

Social engineering against staff or customers
Physical intrusion or on-site testing
Denial of service, load testing or resource exhaustion
Credential brute force or password spraying
Unthrottled automated scanning
Accessing data belonging to real users
scope.CLIENT_SIDE_WEB
scope.DISTRIBUTED_ATTACKS

Scope rules

What Rooted expects in a valid report

In scope

Owned public web assets, auth/session logic, exposed APIs, account boundaries, sensitive data exposure and clear misconfiguration with reproducible impact.

Out of scope

Social engineering, physical testing, spam, denial of service, brute force, persistence, malware, extortion language and access to data that is not yours.

Report quality

Include affected asset, severity, exact steps, observed impact and safe evidence. We score reports faster when the reproduction is clean.

Verification

Rooted reviews the submission and may coordinate with the listed program. Points are released only after the finding is confirmed.