Afterpay Bug Bounty Program

Description

This program is part of Block, Inc. Please note that the scope of this program encompasses Afterpay services only. Vulnerabilities discovered in Block products or services should be reported to the relevant Block, Inc programs: Cash App Square Tidal Block Open Source About Afterpay Afterpay is transforming the way we pay by allowing anyone to buy products immediately and pay over time - enabling simple, transparent and responsible spending. We are on a mission to power an economy in which everyone wins. Afterpay is offered by thousands of the world’s favourite retailers and used by millions of active global customers. Afterpay is currently available in Australia, Canada, New Zealand, the United States and the United Kingdom (where it is known as Clearpay). Afterpay is a wholly owned subsidiary of Block, Inc. (NYSE: SQ). Getting Started Limit your testing to avoid accessing, destroying or otherwise negatively impacting Afterpay customers and merchants data. Ensure you understand the targets, scopes and exclusions below Afterpay functionality is accessible through our mobile apps, or website: https://play.google.com/store/apps/details?id=com.afterpaymobile https://apps.apple.com/au/app/afterpay-shop-now-pay-later/id1230286588 https://www.afterpay.com/en-US https://portal.afterpay.com You can read about Afterpay’s integration methods and APIs at https://developers.afterpay.com/ . We recommend performing testing within the Sandbox environment using the API keys provided in scope section of this program brief. You can also provision yourself a customer account in this environment. Submission Quality When writing a submission, you should provide enough information that allows us to reproduce and gain an understanding of the issue, ideally without needing to ask for further clarification. The advice below should be followed to limit misunderstandings and the need for follow-up questions which slow down the triaging process: Check our ‘Program Scope’ section before you begin writing your report to ensure the issue you are reporting is in-scope for the program. We make no guarantees that findings for out-of-scope targets will be rewarded Provide as many details as possible for our team to assist them with reproducing the issue. Screenshots may be helpful here. Please include your understanding of the security impact of the issue, even if you feel that it may be incomplete. In some cases, it may not be possible to have all of the context on the impact of a bug. If you’re unsure of the direct impact, but feel you may have found something interesting, feel free to submit a detailed report and ask. Whilst adhering to security best practices is important, all submissions must demonstrate some level of security impact to be eligible for a reward. Think about the attack scenario and how the issue can be exploited (even if the full extent of the issue is uncertain). A vulnerability must be verifiable and reproducible for us to be considered in-scope. Program Scope Any finding that is not listed as in scope is still encouraged to be reported via this program. These reports will be rewarded at the discretion of the Afterpay Security Team. All mobile client related vulnerabilities/exploits must be proven to work in the latest version of our mobile application. Please don't submit multiple reports for the same issue impacting both Production & Sandbox environments. Our Sandbox environment is our non-production equivalent, so we expect the same issues to exist in both environments. Rewards for findings in third party software & services used by Afterpay will be reviewed on a case by case basis. There are no guarantees that we will reward these issues, but this will be assessed based on impact. Disclosure Procedures Block recognizes the important contributions the security research community can make. We do not publicly disclose vulnerabilities by default. We take the security of our services very seriously and monitor their use for indications of a malicious attack. In order to distinguish legitimate security research from malicious attacks against our services, we promise not to bring legal action against researchers who: Share with us the full details of any problem found Do not disclose the issue to others until we’ve had a reasonable time to address it and disclosure has been approved by us Do not intentionally harm the experience or usefulness of the service to others Never attempt to view, modify, access, disclose, exfiltrate, use or damage data belonging to Block, its customers, or others Do not attempt a denial-of-service attack Do not perform any research or testing in violation of the law Disclosure outside of Bugcrowd If you would like to report a security vulnerability to us outside of the Bugcrowd platform, please use the contact email found in our security.txt file . We do not offer rewards for responsible disclosure findings submitted outside of Bugcrowd.

Targets

Areas of focus / targets Afterpay Mobile Apps (iOS & Android) Afterpay Marketing site (afterpay.com) Afterpay Consumer Portal (portal.afterpay.com) Mobile API (mobileapi.afterpay.com) Portal API (portalapi.*.afterpay.com) We recommend that testing is performed within our sandbox environment. Support will not be provided to reverse/refund/cancel any Afterpay transactions completed via third party merchants in our Production environment. Please see the documentation available at: https://developers.afterpay.com/afterpay-online/docs/test-environment https://developers.afterpay.com/afterpay-online/docs/postman-collection These links will provide you with instructions on how to interact with the Sandbox environment. Sandbox API credentials are provided in the table below. Keep in mind that testing for DoS / lack of rate limiting vulnerabilities is out of scope for this program. Unfortunately, we do not provide test accounts to researchers for accessing our merchant portal at this time. Name │ Region │ ID │ API Key Bug Bounty Program AU Sandbox 1 │ AU │ 43181 │ 984fa120a16b5b8a3f6d674ce64b030c010153ff3ac7d2c144bd4041c4fb5c44baaa623f4a1d22ef1dc0048b4c0c142d4f5abd381a21b59057a5ab7b7701ca93 Bug Bounty Program AU Sandbox 2 │ AU │ 43483 │ 3923852fa665cd3ddb2bffaac9d828da4e2d03c371a6af9c8d7a00b2a40fb005cd86c91021b004c11b3a739b1b70f538cd4de6b75883b4b303379a2c5893dda7 Bug Bounty Program CA Sandbox │ CA │ 100203785 │ a7f9395b115dae49d1ff2b776e21be55920c4b16b800f8a8d67c519860f28586cd2f1309db0cef3b3d8896a1430f422d7df62e2ac5bc64ebc1966e65f26c21a7 Bug Bounty Program US Sandbox │ US │ 100203697 │ 80f50c878828e2daad38bbe986d5373638926ccfd9ebfcd8a9b754d1720014104757fbdf0bf8609acf1d0258852be8f2f43a2acc6616ae6080e54f5a9a032395 Bug Bounty Program UK Sandbox 1 │ UK │ 400248332 │ 15850c90f4362e53a38ceba5eb874f379745016fbd6fc74c948c0be71b84fc041cb212d93f19aef423b5fb7f3c4b8057d04f465339ddba93557ea9210b8aeb97 Bug Bounty Program UK Sandbox 2 │ UK │ 400248333 │ 42febb9dcd41368bcb0b5ef9a460fe3698b13d8a98d15c763caa14ed07615f62c775a53845a04f7437ed54caf7a58e6bee2301fa35e86e4c3d80adef8801fb8 Finding Exclusions The following finding types are excluded from the bounty: Lack of rate limiting controls Open redirect vulnerabilities Security vulnerabilities on merchant sites that accept Afterpay as a payment method Any target that is covered under another Block bug bounty program (e.g. Square, Square Open Source, Cash App, Tidal) Social engineering or phishing attempts against employees Inconsistencies related to our fraud prevention tooling Descriptive error messages (e.g. stack traces, application or server errors, version disclosure) Clickjacking Logout Cross-Site Request Forgery (logout CSRF) Content Spoofing Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality Lack of Secure/HTTPOnly flags on non-sensitive Cookies Lack of Security speed bump when leaving the site Login or Forgot Password page brute force Username / email enumeration. Missing or misconfigured HTTP security headers SSL/TLS Issues without a demonstrable impact, such as: SSL weak/insecure cipher suites Padding oracle attacks SSL Forward secrecy not enabled Self-XSS Known vulnerabilities in libraries that Afterpay uses, unless you can prove exploitability Missing or incorrect SPF records of any kind. Missing or incorrect DMARC records of any kind. Information disclosure of non-confidential information (e.g. merchant IDs, merchant store locations, etc.) The ability to upload/download viruses or malicious files to the platform Email bombing/flooding/lack of rate limiting Broken links hosted on our website Leaked user credentials found online Cache poisoning resulting in DoS