ABCP Platform
Vulnerability disclosure program on security.txt abcp.ru
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
Scope
4 assets you may test, 2 excluded.
APIs 1
- Shops APIs (public-facing)
Domains 1
- abcp.ru
Products and areas 2
- A control panel of shops on ABCP Platform
- Online shop on ABCP Platform
Out of scope (2)
- Denial-of-Service (DoS) attacks
- Third-party services not managed by us
Rules
What the policy asks of you, and the bug types it won't reward, quoted from ABCP Platform's policy.
While testing
-
You acknowledge that any information obtained in the course of participation is confidential and must not be disclosed without written consent from the ABCP Platform team.
-
Attacks that harm the availability or integrity of services (e.g., DoS, brute-force), or automated vulnerability scans generating significant traffic are prohibited.
-
Social engineering against ABCP Platform staff or clients, phishing, or any impact on physical objects (offices, datacenters) is not allowed.
-
Only the following SQL actions are allowed: Reading database name/version/user/hostname
-
Retrieving schema/table/column info. Other actions require prior approval.
-
Modifying or deleting files (except your own test account)
-
Uploading large or malicious files
-
Reading is limited to safe files like /etc/passwd, unless explicitly allowed
Not accepted
-
Vulnerabilities in resources outside of the scope
-
Information leaks about usernames, emails, phone numbers, public info (e.g., usernames)
-
Low-impact XSS/CSRF, including self-XSS, outdated browsers
-
Issues without clear security impact (e.g., logout CSRF, CSP headers)
-
Use of leaked credentials (unless PoC shows real risk)
-
Misconfigurations, theoretical issues without exploitability
-
Denial of Service via traffic floods or brute-force
-
Issues requiring malware, root access, MITM, or physical proximity
-
Reverse engineering or lack of obfuscation alone
-
Spam/malware uploads, weak CAPTCHA reports
-
Social engineering-based vulnerabilities
-
Vulnerabilities in third-party tools unless ABCP Platform data is at risk
-
Non-security bugs, non-reproducible or speculative attacks
-
Self-XSS by store administrators
-
Arbitrary file uploads to NodaCDN by store administrators
-
Unverified email address changes
Summarised with AI from the company's policy, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.