Program Overview: Waldo is dedicated to creating a safe and secure experience for all users. We invite ethical hackers and security researchers to help us identify and fix security vulnerabilities. In return, you’ll earn some exclusive Waldo swag as a token of our appreciation!

Scope: Our primary target for testing includes:

• https://www.waldo.fyi

Eligible Vulnerabilities: We’re looking for reports on:

• Cross-site scripting (XSS)
• Authentication or authorization flaws
• Security misconfigurations
• Server-side vulnerabilities
• Any other vulnerabilities that might compromise user data or site functionality

Out of Scope:

• Spam or social engineering attacks
• Clickjacking
• DOS/DDoS attacks
• Previously known vulnerabilities

Rewards: Eligible reports will receive Waldo-branded swag such as:

• T-shirts
  • Stickers
• Exclusive pins
• Hoodies (for particularly impactful findings!)

Guidelines:

1. Only test against accounts you own.