I originally sent this via the Contact page, but I realized this could be useful to others, so here it goes on Meta. If I get a response to my contact message before a staff member answers here, I can self-answer. If a staff member answers here, that is great too.

Stack Exchange runs a bug bounty program on HackerOne. There are also the Hashcode sites, which are controlled by a staff member (Nic). Hashcode has a physics site and a tourism site. Unfortunately, they are abandoned and are filled with spam.

A staff member commented the following (when asked about those sites):

To clarify here: Stack Exchange has absolutely nothing to do with the maintenance of the Hashcode sites. Outside of Nic working here and keeping the servers up, no other SE employee ever touches those sites, has access to do anything with them, or has any say in what happens to them. This is entirely up to Nic and whatever he wants to do with them.

So it appears that Nic can do whatever he wants with those sites.

Those are not on the list of approved domains for HackerOne.

I'd like to see if I can find any significant vulnerabilities (i.e., like remote server access, not a tiny XSS oops) in those sites (and of course report them to SE). They are controlled by someone at SE, but they aren't listed on the HackerOne page, so I wanted to know if it was all right if I see if I can attempt to break into them.

Bonus: is stackoverflow.co fair game as well?

  • 3
    Well - I'd guess if you reported them they'd get passed on to nic, but they wouldn't be fair game for a bounty. I'd also guess the stackoverflowsolutions and so.co domains run software not developed by SE so likewise, they'd need to pass on any such reports to the appropriate vendor for support.
    – Journeyman Geek Mod
    Jun 8 at 1:30
  • @JourneymanGeek Totally fine with there being no bounty, that makes sense. I'm asking if it is fine to attempt to break into them (I'm just curious if I can get anywhere, not trying to get a bounty from it).
    – cocomac
    Jun 8 at 1:33
  • 2
    Only the list of approved domains are in-scope. Jun 8 at 1:43
  • 8
    Correction: They aren't controlled by SE and are not located on any of our servers. The company couldn't care less what happens with them because they aren't ours. If we controlled them, we would've shut them all down long ago because of the security concerns of running unmaintained code. But we don't. It is entirely up to Nic whether he's comfortable with you trying to break into them.
    – animuson StaffMod
    Jun 8 at 1:48
  • 3
    Why would you think that it's OK, when you've found a list of sites where such does apply, and these that you're asking about are specifically not on that list? The conclusion you've drawn is exactly the wrong one which you should be drawing if you are going to be working in this area anywhere. While you are welcome to ask. Asking is good/fine, but the default is that it's not acceptable to do anything that's not been explicitly agreed to. In other words, if it's not on the list, then it's not on the list and not acceptable. [It is fine to ask, just not to assume it should be OK.]
    – Makyen
    Jun 8 at 1:53
  • It doesn't appear that SE has a bug bounty program. There's no way to send reports directly on HackerOne - all it does is provide some information and link to the Contact form.
    – Smitop
    Jun 8 at 1:54
  • 1
    @Makyen I'm sorry if I was unclear. I did not mean that I thought it was acceptable. I meant that I didn't know if it was fine, and so I should ask. I meant that I thought it could be allowed by SE (or in this case, Nic), but that I had to ask before I tried anything. I edited my question to be more clear
    – cocomac
    Jun 8 at 2:05
  • @cocomac The only purpose of bug bounty programs is to incentivize whitehats reporting bugs. There's no reason you can't find bugs and report them anyway, you just can't expect to get paid for it. Jun 8 at 2:11
  • @forestdistrustsStackExchange I agree with that, but I wanted the go-ahead from SE (or Nic in this case) before trying anything
    – cocomac
    Jun 8 at 2:32
  • 6
    @animuson As far as I could tell, even though Stack Exchange, Inc. doesn't have any technical control over the server, it still has legal ownership of it, as it was property of Nic's former company that operated the hashcode.ru network, and that company was fully acquired by Stack Exchange, Inc. making them the legal owner of any assets previously belonging to Nic's company. Is that so? Jun 8 at 2:34
  • 3
    @cocomac You only need the go-ahead before actually exploiting a bug. You can try to find issues without doing that, e.g. reporting outdated software running or a page that is exposed which shouldn't be. Jun 8 at 2:36
  • @cocomac even if you find vulnerabilities, most chances are they're already fixed on SE sites. You can hack into any ancient unmaintained site over the internet, those "hashcode" sites got nothing to do with Stack Exchange, as animuson tried to explain many times already. Jun 8 at 11:42


You must log in to answer this question.

Browse other questions tagged .