IKEA bug bounty programs

Out of scope 28

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• Account enumeration using brute-force attacks

• Any activity that could lead to the disruption of our service (DoS).

• Attacks requiring MITM or physical access to a user's device.

• Clickjacking on pages with no sensitive actions

• Comma Separated Values (CSV) injection without demonstrating a vulnerability.

• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS

• Credentials obtained by malware, data leaks or shared on the dark web

• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions

• Issues that require unlikely user interaction

• Mail configuration issues including SPF, DKIM, DMARC settings

• Missing best practices in Content Security Policy.

• Missing cookie flags on non-sensitive cookies

• Missing http security headers which do not lead to a vulnerability

• Missing HttpOnly or Secure flags on cookies

• Open redirect - unless an additional security impact can be demonstrated

• Presence of autocomplete attribute on web forms

• Previously known vulnerable libraries without a working Proof of Concept.

• Rate limiting or bruteforce issues on non-authentication endpoints

• Reports from automated tools or scans

• Reports of SSL/TLS issues, best practices or insecure ciphers

• Self-exploitation attacks

• Social Engineering attacks

• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).

• Solutions affected by known CVEs published less than 30 days ago

• Tabnabbing

• Test versions of applications

• Vulnerabilities only affecting users of outdated or unpatched browsers

• Weak password policies and password complexity requirements