BitGo Managed Public Bug Bounty Engagement

Description

BitGo provides the most secure and scalable solutions for the digital asset economy, offering regulated custody, borrowing and lending, and core infrastructure to investors and builders alike. Founded in 2013 — the early days of crypto — BitGo pioneered the multi-signature wallet and later built TSS to improve upon other companies’ MPC offerings. Between multi-sig and TSS, BitGo offers the safest technology on the market and safeguards over 600 tokens across a wide variety of blockchains. Over the years, BitGo has expanded from offering wallets into providing a full-suite solution that lets clients hold assets safely and then put them to work. Today, BitGo is the leader in digital asset security, custody, and liquidity, providing the operational backbone for more than 700 institutional clients in over 50 countries — a list that includes many regulated entities and the world’s top cryptocurrency exchanges and platforms. BitGo also processes approximately 20% of all global Bitcoin transactions by value. We're looking for passionate and driven researchers who can help us keep our platform secure and join us on our mission. Good luck and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of BitGo not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to BitGo, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation. If you discover credentials during testing in our program, cease testing immediately. Do not attempt to validate their functionality. Instead, submit a report containing the identified credentials, specify the location where they were found, and indicate if there is potential for additional Personally Identifiable Information (PII) in that location. Accessing accounts that you do not own is a violation of our code of conduct and will result in immediate removal from the program. There is no guarantee of a reward for these submissions. Vulnerabilities involving leaked credentials will be reviewed on a case by case basis. Please note this includes leaked credentials from third parties only: this includes credential dumps found on websites, leaked credentials from indirect sources other than the listed in scope targets. There is no guarantee of a reward for these submissions. Access/Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Traffic Identification Please add the following header to your HTTP traffic to prevent interruptions and verify non-malicious behavior: X-Bug-Bounty: Bugcrowd- Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further.

Additional information

The following individuals are not eligible to participate in our bug bounty program: Current full-time, part-time, temporary, or contract employees, interns Former employees who have left the organization within the past 12 months Immediate family members of current employees Vendors and contractors who have access to our source code or internal systems

In Scope (in scope)

Target Information: app.bitgo.com - hosts the Web application that is used by BitGo customers to login to and use the BitGo Platform app.bitgo-test.com - Equivalent of the production web application in the Test Environment Note: The test environment allows "000000" as the 2FA token Testing rate limits is not in scope for any target Passkey is currently in the testing phase and is not in scope