Vulnerability Disclosure Policy and Bug Bounty Programme

Last revised: 6 August 2026 - Reports to: security@hostafrica.com
Operated by: Host Africa (Pty) Ltd, trading as HostAfrica

---

Our commitment

HostAfrica hosts websites, email and servers for businesses across Africa. We would rather hear about a weakness in our systems from you than read about it somewhere else.

Where this policy conflicts with our Terms of Service or Acceptable Use Policy, this policy prevails - but only for research conducted within its scope and in compliance with it.

---

Authorisation and safe harbour

If you research in good faith under this policy, we authorise your access to the in-scope systems below. That authorisation is what makes your testing lawful: section 2(1) of the Cybercrimes Act 19 of 2020 makes it an offence to unlawfully access a computer system, and access with the owner's authorisation is not unlawful. It is personal to you, revocable, and limited to what is described here.

Where we conclude your research complied with this policy, we will not bring a civil claim against you (except for breach of this policy, IP infringement, or actual damage caused), we will not refer the matter to law enforcement except where required by law, and we will on request confirm in writing that your research was authorised. That is the extent of our undertaking - we do not commit to intervening in or funding any proceedings against you.

Limits, stated plainly. This is our undertaking, not a statutory immunity: South Africa has no legislated safe harbour for security researchers. It covers only systems we own and control, and cannot extend to customer-owned content, which is not ours to authorise. Kenyan, Nigerian and Tanzanian law likewise turn on whether access was authorised, so our authorisation is relevant there, but we cannot guarantee how any prosecutor or court will treat it.

When in doubt, ask before you test. security@hostafrica.com.

---

In scope

Only these assets. Listing a domain does not authorise activity beyond what this policy permits.

Group brands. Host Africa also operates VPS.co.za, Cloud.co.za, AmpleHosting, Gweb, HobHost, DomainKing, Naijawebhost, Web4Africa, Webmanager, Sasahost, EAC Directory, deepAfrica, Hostpoa, Jijihost and Cloud Backup.

Third-party software. Our client area and panels run on vendor products (WHMCS, cPanel/WHM, DirectAdmin). The line is authorship, not hostname: defects in our configuration, integration, provisioning or account isolation are in scope. Defects in the vendor's own product affecting all its users are not - report those to the vendor. We will help you make contact and still credit you.

---

Testing accounts

No shared credentials. Register your own account, buy the entry-level shared plan, then email security@hostafrica.com from that address - we will credit up to three accounts for one month.

Cross-tenant testing between accounts you control is expressly authorised. Proving one customer can reach another's data is the most valuable thing you can find here, and it takes two accounts. Accessing an account you do not control is never authorised, even to demonstrate a real flaw - if you think a finding can only be proven that way, stop and email us.

Container or hypervisor escape needs a VPS: ask first and we will authorise a specific instance in writing. For SSRF, use our canary endpoint rather than pivoting - ask for the hostname and proof token.

---

Rules of engagement

• Send X-BBP-Researcher: <your-handle> where you can, and test from a stable source IP you disclose to us. This protects you - it is how we tell research from a real attack.
• Maximum 10 requests per second against any host.
• Access the minimum data needed to prove the finding. Do not modify or delete anything.
• No persistent access - no webshells, backdoors or held-open shells. No pivoting. No degrading service.

Never: denial-of-service, volumetric, stress or brute-force testing; social engineering, phishing or pretexting against our staff, contractors or customers, including via live chat, the support desk, phone or social media; physical attempts against offices or data centres; testing customer-owned content.

If you encounter personal information: stop, do not retain a copy, and tell us the same day - POPIA section 22 may oblige us to notify the Information Regulator and affected data subjects, and that clock starts early. Handling it properly will never count against your reward; concealing it ends your participation. You must confirm in writing that you have deleted any such data once it is no longer needed for your report.

---

Out of scope

Customer-owned content and infrastructure

The exclusion researchers most often get wrong. Customer websites, applications, databases, mailboxes, VPS instances and dedicated servers are not in scope - even though they run on our infrastructure, resolve to our IPs, and may sit on *.hostafrica.com subdomains. We do not own them and cannot authorise you to test them.

The distinction: a flaw in our platform letting one customer reach another's data is squarely in scope and is what we most want. A flaw in a customer's own outdated CMS is not - report it to them, or to abuse@hostafrica.com if it is being exploited.

Not rewarded

• Scanner output without demonstrated impact
• missing headers or cookie flags and best-practice advice without a working exploit
• TLS/SSL configuration, weak ciphers, certificate issues
• DNS configuration, missing SPF/DMARC/DKIM, subdomain enumeration without demonstrated takeover
• open ports and version disclosure
• clickjacking on pages with no sensitive action
• self-XSS and XSS needing unrealistic interaction
• logout CSRF and CSRF on non-sensitive actions
• open redirects unless you show loss of a session token or personal data
• user or email enumeration on customer-facing systems
• password policy complaints and email validation quirks
• rate limiting without demonstrated impact
• third-party libraries with no demonstrated impact on us (a CVE number is not a finding)
• anything needing a compromised device, stolen credential or obsolete browser
• third-party services we consume but do not control, including vendor products, upstream networks and payment gateways
• abuse, spam or phishing hosted by a customer (abuse@hostafrica.com)
• theoretical findings with no plausible attack path

Reports generated substantially by automated tooling or language models and submitted without independent verification are held to the same evidence standard as everything else. If it does not reproduce, it is closed, and a pattern of them ends your participation.

Leaked credentials: if you find our credentials or keys exposed, email us - do not test whether they work. Authenticating with them breaches this policy, and unlawful use of a password is a separate Cybercrimes Act offence. We reward exposed credentials we confirm were live against an in-scope asset. We do not reward anything from third-party breach dumps or credential-stuffing lists.

---

What we reward

Including but not limited to:

• remote code execution
• SQL, command, template or XML injection
• authentication bypass and session handling flaws
• broken access control between customer accounts, including IDOR and tenancy escape (prove between accounts you control)
• privilege escalation
• 2FA bypass
• container or hypervisor escape (pre-authorised instances only)
• SSRF with demonstrated internal reach (via our canary)
• directory traversal
• insecure deserialisation
• exposed source control, backups or config containing secrets
• demonstrated subdomain takeover on an in-scope domain
• exposure of customer personal information, credentials or payment data
• provisioning or billing logic flaws with material financial impact
• stored XSS in the client area or panel with real session takeover
• HTTP request smuggling
• exploitable race conditions

If your finding is on neither list, send it anyway. These lists guide the assessment; they do not replace it.

---

How to report

Email security@hostafrica.com - the only official channel.

Your report must contain specific, working steps to reproduce the bug on a named platform operating under the HostAfrica brand. This is not a formality. A report we cannot reproduce is a report we cannot fix, and vague or unsubstantiated submissions will be disqualified from the programme.

Include:

1. Summary - the issue in two or three sentences.
2. Affected asset - the exact URL, endpoint or hostname, and which HostAfrica platform it belongs to.
3. Impact - what an attacker achieves, and what they need first.
4. Reproduction steps - specific enough for us to reproduce independently, without guesswork. Screenshots or a short recording help.
5. Requests and responses - the relevant HTTP traffic.
6. Your test accounts - email addresses or account IDs used.
7. Source IPs and timestamps with time zone - so we can separate you from a real attack in our logs.

For RCE, additionally: prefix uploaded files with bugbounty- and a timestamp; give the callback IP and port if used; disclose everything you accessed, including anything seen unintentionally. Prove it with whoami, hostname or id and stop there.

English is handled fastest; Afrikaans also fine.

Response targets

Best efforts, not contractual service levels.

Business days exclude South African public holidays.

---

Rewards

Severity starts from CVSS v4.0, then adjusts for real exploitability and the sensitivity of what is exposed. A high score with no practical attack path is rated down; a modest score against highly sensitive data is rated up.

Retests, by our invitation: $75 Low and Medium, $150 High and Critical.

How rewards are decided

• Only the first report of a previously unknown issue is eligible. Duplicate reports do not receive a bounty. If yours is a duplicate we will tell you, and where we can we will show you evidence of prior knowledge.
• Issues we already knew about are likewise not eligible.
• Reports without specific reproduction steps are disqualified - see How to report.
• One reward per root cause. Several endpoints sharing one bug is one finding.
• Chains are assessed on the impact of the chain, which may exceed the sum of the parts.
• We may pay above these ranges for exceptional work. All reward decisions are ours and final.

We weigh severity, exploitability, sensitivity of the affected system, risk to customers, and report quality. A clear, well-evidenced report is worth more than a terse one describing the same bug.

Budget

Approximately USD 12,000 per year. If exhausted we will say so on this page and continue to triage, fix and credit reports without cash rewards until the next cycle begins on 1 March. Reports submitted while the budget is open are paid from it even if assessment finishes later.

For context: we are a company of around sixty people. Hostinger pays up to $25,000 and DigitalOcean up to $10,000, but both are one to two orders of magnitude larger than us. We would rather publish a ceiling we will honour than a headline we will not.

Payment

US dollars by bank transfer. As a South African entity we report outward payments under exchange control rules, so we need your full banking details and country of residence.

Small international transfers cost more in fees than they are worth, so awards under $200 can be taken as hosting credit or accumulated until your total passes $200 - your choice. We bear our own transfer fees; your receiving bank's charges are yours.

Eligibility

At least 18, or 16 with documented guardian consent. Not open to current or former HostAfrica employees and contractors, their immediate families, or supplier staff reporting on systems they work on. Tax in your jurisdiction is yours. We cannot pay where sanctions prohibit it.

Demanding payment before disclosing details, or threatening publication to extract a larger reward, ends your participation and forfeits any reward.

---

Disclosure

Keep details private until we ship a fix, and coordinate timing with us.

Our default is 90 days from your report. After that you may publish whether or not we have finished, on one condition: remove any customer personal information. You do not need our permission and the bug does not need to be fixed. We would rather be embarrassed by a write-up than leave a finding unresolved.

If we need longer we will explain why and propose a date. If we go silent for 14 days after acknowledging your report, chase us; if we still do not respond, that is our failure and you may proceed on the 90-day clock.

We will credit you by name or handle unless you would rather we did not.

---

Legal

Your personal information. We collect your name or handle, email, source IPs, age-verification evidence where relevant, and banking details where a reward is payable, and use it solely to assess and pay your report, distinguish your testing from real attacks, and meet our legal obligations. We keep it as long as tax and security records require. Your POPIA rights, including access and correction: Privacy Policy.

Submissions. You keep ownership of your report and grant us a perpetual, irrevocable, worldwide, royalty-free, sublicensable, non-exclusive licence to use, reproduce, adapt and publish it for any lawful purpose. Nothing obliges us to implement it, or prevents us from independently developing similar fixes.

Confidentiality. Treat what you learn about our systems, staff, customers or security as confidential and use it only to support your report. This survives the end of your participation and is separate from the disclosure timetable.

Changes and termination. We may suspend or end your participation for breach or risk to our systems, customers or staff, and may modify or discontinue the programme at any time. We may update this policy; changes take effect on publication. Reports are assessed under the version in force when submitted, except that budget provisions operate on the date of assessment.

Governing law. South African law, exclusive jurisdiction of the South African courts.

---

This policy: security@hostafrica.com - Abuse or phishing on our network: abuse@hostafrica.com