Security

Responsible disclosure & bug bounty policy

We want reports of any vulnerability you find in USA 5G Proxies. Scope, paid findings, unpaid findings and the reporting process are all set out here, so neither side gets a surprise.

Scope

In scope

This website, usa5gproxies.com
Customer dashboard (the one you sign in to) plus its API
Dashboard handling of proxy credentials, API keys and rotation links

Out of scope

Modem hosts, proxy gateways and the mobile carrier networks behind those
Services run by third parties: Cloudflare, Telegram, email providers, payment processors
Marketing assets served from legacy CDN paths
Any customer's account or data other than your own

What we pay

We reward demonstrated impact on our customers or our systems. Amounts are in USD.

Critical

$100 – $250

Remote code execution on our servers
SQL injection with read or write access to customer data
Getting past the login of any account without having its credentials
Manipulating payments or balances to get proxies, credit or refunds without paying
Mass exposure of proxy credentials or personal data belonging to other customers

High

$50 – $100

IDOR: viewing or altering the account details, orders or proxies of another customer
Stored XSS executing in an admin's or another customer's session
Moving from a customer login up into admin functions
Server-side request forgery reaching internal services
Stealing a session, rotation link or API key from another account

Medium

$20 – $50

CSRF against an action that alters account state
Reflected XSS where the victim has to click a link
Bypassing a rate limit with a demonstrated account takeover as the result
Business-logic or pricing errors with demonstrated financial impact

Low / Informational

Not paid, though we acknowledge them and fix what is warranted. Check the full list below before writing your report.

Rules of engagement

First valid report wins. We do not pay for duplicates or for issues already known to us. Each root cause earns a single payment, regardless of endpoint count.
Prove it, then stop. Access only your own accounts and data. Where a test would expose another person's data, stop at the first proof and report. No pivoting, no downloading, no persistence.
Do not degrade the service. Do not load test, run automated fuzzing at volume, or test against modem hosts, proxy gateways or carrier networks. Those are out of scope entirely.
Give us time. Hold publication until the fix is in and 30 days have gone by. Once a fix is live, you will hear from us.
Severity is ours to set. Our reference is the Bugcrowd Vulnerability Rating Taxonomy, applied to impact on our own systems. We set each amount at our discretion within the ranges above and pay by USDT or PayPal.

Safe harbour. Research that follows these rules is authorised. Good-faith testing within scope will not bring legal action from us. We ask the same good faith back: no “pay first, details later”, no extortion, no threats of disclosure.

What we do not pay for

Low or Informational is the highest these get. They get read, and what is worth fixing gets fixed. No bounty is issued, even with a Critical or High label on the report.

Session that survives a logout, password change or password reset and runs until its token expires
Security headers (HSTS, CSP, Referrer-Policy, X-Frame-Options) that are absent or “weak”, without a working exploit
Clickjacking where the page has no sensitive action
Attributes of any cookie other than a session cookie
Enumerating usernames or emails, timing and error messages included
Observations on login, forgot-password or rate limits with no demonstrated account takeover
Opinions about password policy: complexity, length, no forced rotation, common-password lists
No two-factor authentication, or 2FA left optional
XSS the attacker alone can trigger in their own session, or Self-XSS
CSRF limited to harmless forms: login, logout, language and the like
Open redirects with no token or credential leaked
Disclosure of paths, stack traces, server banners or software versions with no sensitive data
SPF, DKIM or DMARC configuration reports
Raw scanner findings that arrive without a proof of concept
Load-generating tests of any kind: denial of service, brute force, resource exhaustion
Physical attacks; phishing or social engineering aimed at our customers or staff
Flaws in third parties we rely on: email providers, Cloudflare, Telegram, payment processors
An outdated library, unless a working exploit hits our deployment
Attacks needing a rooted phone, a man-in-the-middle position or a compromised device
Known-issue duplicates, theoretical risks and best-practice advice

How to report

Email [email protected] with the subject Security report. Send a proof of concept, the account you used, the affected URL and the exact reproduction steps. Expect acknowledgement within 5 business days and a severity decision within 10 business days.

Machine-readable contact details are at /.well-known/security.txt.

Send a report

Policy last updated 2026-11-08.