Security

Responsible disclosure & bug bounty policy

We want to hear about any vulnerability you find in Chicago Proxies. Here you will find what is in scope, what we pay for, what we don't pay for and how to report, so neither side gets surprised.

Scope

In scope

This website, chicagoproxies.com
The customer dashboard you log in to, plus its API
Inside the dashboard, rotation links, API keys and the handling of proxy credentials

Out of scope

Modem hosts, proxy gateways and the mobile carrier networks behind them
Services run by third parties: payment processors, Telegram, Cloudflare, email providers
Marketing assets served from legacy CDN paths
Customer accounts or data belonging to someone else

What we pay

We reward demonstrated impact on our systems or our customers. Amounts are in USD.

Critical

$100 – $250

Remote code execution on our servers
SQL injection able to read or write customer data
Getting into any account without its credentials by bypassing authentication
Manipulating payments or balances to get proxies, credit or refunds without paying
Other customers' proxy credentials or personal data exposed in bulk

High

$50 – $100

Viewing or editing another customer's proxies, orders or account details (IDOR)
Stored cross-site scripting that executes in an admin's or another customer's session
Escalating privileges from a customer account into admin functions
Server-side request forgery reaching internal services
Stealing another account's API key, rotation link or session

Medium

$20 – $50

Cross-site request forgery against an action that changes the account's state
Reflected cross-site scripting that only works if the victim clicks a link
Bypassing a rate limit in a way that leads to a demonstrated account takeover
Business-logic or pricing errors that have a demonstrated financial impact

Low / Informational

We acknowledge and fix these if warranted, but don't pay. You can check the full list below before you write the report.

Rules of engagement

First valid report wins. We do not pay for duplicates or for reports of issues we already know about. Each root cause is paid once, no matter how many endpoints it touches.
Prove it, then stop. Access only your own accounts and data. Should a test start to expose another person's data, stop at the first proof and report it — no pivoting, downloading or persisting.
Do not degrade the service. Skip load testing and high-volume automated fuzzing, and leave proxy gateways, modem hosts and carrier networks untested. Those are out of scope entirely.
Give us time. Hold off publishing until the issue is fixed and 30 days have gone by. You'll hear from us once a fix is live.
Severity is ours to set. Impact is rated on our own systems, with the Bugcrowd Vulnerability Rating Taxonomy as our reference. We set the payment amount at our discretion within the ranges above and pay it by PayPal or USDT.

Safe harbour. Research that follows these rules is authorised. Good-faith testing within scope will not lead us to pursue legal action against you, and in return we ask for the same good faith toward us: no extortion, no threats of disclosure, no “pay first, details later”.

What we do not pay for

At most, we accept these as Low or Informational. We read them and fix whatever is worth fixing, but they earn no bounty, and labeling the report Critical or High does not change that.

Sessions that keep working after a logout, password change or password reset, right up to token expiry
Security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) that are missing or “weak”, with no working exploit
Clickjacking on pages with no sensitive actions on them
Attributes on any cookie other than a session cookie
Enumerating emails or usernames, through timing or error messages included
Observations about login, forgot-password or rate limits with no demonstrated account takeover
Opinions on password policy: length, complexity, common-password lists, no forced rotation
No 2FA at all, or two-factor authentication left optional
Self-XSS, meaning XSS the attacker can trigger only in their own session
CSRF against login, logout, language or similar non-sensitive forms
Open redirects that leak no token or credential
Disclosure of a software version, server banner, stack trace or path with no sensitive data
SPF, DKIM or DMARC configuration reports
Automated scanner output with no proof of concept
Any test that generates load, plus denial of service, resource exhaustion or brute force
Phishing or social engineering aimed at our staff or customers; physical attacks
Problems in third-party services we rely on: payment processors, Telegram, Cloudflare, email providers
Old library versions with no working exploit against our deployment
Attacks needing a rooted phone, a compromised device or a man-in-the-middle position
Theoretical risks, best-practice advice and duplicates of issues already known

How to report

Email [email protected] with the subject Security report. Give us the affected URL, the exact steps to reproduce, which account you used and a proof of concept. You will hear back within 5 business days, with a severity decision within 10 business days.

Machine-readable contact details are at /.well-known/security.txt.

Send a report

Policy last updated 2026-10-10.