Bitpanda Ongoing Bug Bounty

Description

No technology is perfect and Bitpanda believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our targets. Good luck, and happy hunting! Bitpanda GmbH (Bitpanda) Bitpanda.com, Europe's leading retail exchange for buying and selling cryptocurrencies, has made every effort to secure its platform and mobile applications and eliminate all software vulnerabilities in its systems. As part of Bitpanda's security guidelines, we appreciate your cooperation in investigating and reporting any vulnerabilities of the Bitpanda Services (as defined below). Attention Rewards will be paid out in Bitcoins (BTC) Payments will be made exclusively through our platform. To do so, you must have a verified account in Bitpanda. Once your submission is accepted, please provide either of the following to receive your reward: Email address registered on out Bitpanda platform Valid UserID For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. The use of Automated scanners is strictly prohibited.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Bitpanda not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Bitpanda, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Access: For all testing purposes add an HTTP header to your request to access the target which includes your @bugcrowdninja.com email address X-Bug-Bounty: [email protected] Identifier │ Header │ Example @bugcrowdninja.com Email Address │ X-Bug-Bounty: Bugcrowd- │ X-Bug-Bounty: [email protected] Testing on user accounts We would like to clearly state that accessing or using real user accounts that you don't own and their associated information for testing purposes is not allowed under any circumstances. We kindly request that you only use test or personal accounts while conducting your security assessments. Focus Areas: In the following, you find some examples of security issues that may be eligible for a reward in accordance with this program: Leakage of data Getting malicious access to user funds Price manipulation within the platform Code injection Cross-site scripting (XSS) Cross-site request forgery (CSRF) Remote code execution Privilege escalation Authentication bypass Remote Code Execution (RCE) XML External Entity Injection (XXE) Business logic Vulnerabilities (with impact) Vulnerabilities of Non-Bitpanda Services directly lead to a relevant impact on a Bitpanda Service. Out of Scope Vulnerabilities All vulnerabilities of Bitpanda Services that require or are related to the following are not eligible for a bug report and reward and are called ineligible vulnerabilities. Such ineligible vulnerabilities are in particular: UX issues not relating to security impacts Failure to Invalidate Session On Password Reset and/or Change Broken Link Submissions (Includes Hijacking of broken links) Vulnerabilities of any third-party software or application that interacts with Bitpanda Services. Attacks related to email servers, email protocols, and email security (e.g., SPF, DMARC, DKIM, or email spam) Social engineering & identity theft actions Disclosure of known public files or directories (e.g., robots.txt). Attacking of physical security, DOS/DDOS, spamming, etc. Vulnerabilities of Non-Bitpanda Services not leading to a relevant impact on a Bitpanda Service. Vulnerabilities were related to outdated, unpatched browsers or operating systems. Vulnerabilities Bitpanda can't reproduce. Vulnerabilities in any open-source library. Vulnerabilities in existing banking functionalities (e.g., credit cards, wire transfers) can lead to any kind of abuse. Google Maps API Key Theoretical vulnerabilities without actual proof of concept. Clickjacking/UI redressing/TapJacking Missing HTTP security headers, specifically (https://www.owasp.org/index.php/List_of_useful_HTTP_headers), e.g. Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP, Content-Security-Policy-Report-Only. Cache-Control and Pragma Lack of HSTS Lack of Secure/HTTPOnly flags, SSL/TLS Issues, e.g: SSL Attacks such as BEAST, BREACH, Renegotiation attacks, SSL Forward secrecy is not enabled, SSL weak/insecure cipher suites. Most brute-forcing issues without a clear impact Reports of missing “best practices” or other guidelines do not indicate a security issue. "Self" XSS Username / email enumeration. Insufficient session expiration Logout Cross-Site Request Forgery (logout CSRF). Recently (less than 30 days) disclosed 0day vulnerabilities Issues that require physical access to a victim’s computer/device Missing reCAPTCHA/RateLimit. Login or Forgot Password page brute force and account lockout not enforced. Descriptive error messages (e.g., Stack Traces, application or server errors). Exploits that are only possible on Android version 9.x and below Exploits that are only possible on IOS version 12.x and below Exploits that are only possible on a jailbroken device Jailbreak and root detection Crashing your application Testing for weak credentials Email bombing/Flooding/rate limiting Vulnerabilities Bitpanda can't reasonably fix or do anything about it (e.g., heart bleed bug or bugs concerning telecommunication systems) Vulnerabilities that have not been responsibly investigated. Vulnerabilities that have not been thoroughly reported. Vulnerabilities that have been known by us or reported by someone else first. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

Tier 1 Assets (in scope)

Important As a company operating in a highly regulated sector, we need to take our responsibility to our user base very seriously. This means that we are required to have specific conditions in place, even for researchers testing on our platform. We understand that this may be frustrating, but please know that it is necessary for us to maintain compliance. This means the following for you as a researcher: When you first log into our platform, you will have access to a limited range of testing features. However, once you verify , you will have access to all features. To make the verification process as smooth as possible, we can only accept certain documents from the countries listed here . Please refer to our website for a list of accepted documents. Thank you for your understanding and cooperation.