Bitso Managed Bug Bounty Engagement

Description

Bitso is Latin America’s leading Financial Services company powered by crypto. With millions of clients, we are leading the financial revolution with borderless, secure, transparent, and accessible financial products. With the mission to unlock the power of borderless, secure, and easy-to-use financial products by making crypto useful, we are committed to empowering the region with universal access to the digital economy of the future and enabling a fairer monetary system. No technology is perfect and Bitso believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Good luck, and happy hunting!

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Bitso not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Bitso, you can report it to Bugcrowd Portal . However, be aware that such reports will be ineligible for rewards or points-based compensation. Focus Areas We're particularly interested in reports covering: Access control vulnerabilities — accessing data or functionality that belongs to another user or account (IDOR, broken object-level authorization, etc.). Privilege escalation — vertical or horizontal, including moving from a retail account to admin or internal functionality. Authentication weaknesses — 2FA bypass, session handling flaws, account takeover vectors, password reset flaws. Business logic flaws in financial flows — anything that lets you manipulate balances, trades, deposits, withdrawals, or conversion rates in ways the platform shouldn't allow. Race conditions — especially around transactions, transfers, and balance updates. KYC/onboarding bypass — skipping or spoofing identity verification steps. API vulnerabilities — broken authorization, excessive data exposure, or rate-limit issues with demonstrated impact on our public and mobile APIs. Findings that demonstrate direct impact on customer funds or personal data will be prioritized and rated accordingly. Out-of-Scope Vulnerabilities We can only reward findings on systems that Bitso actually owns and operates. The following issue types are out of scope for this program: Supply chain attacks — compromised third-party dependencies, development tools, IDE extensions, packages, or vendors used by Bitso or its employees, including cases where an employee is targeted directly through one of these. Even if the end result exposes Bitso information, the root cause lives outside our environment and is not a vulnerability in our systems. Social engineering — phishing, vishing, smishing, or similar attacks against employees or customers. Physical attacks — against offices, data centers, or personnel. DoS/DDoS and brute-forcing — see the Access/Traffic Identification section above. Third-party services — issues in services we use but don't operate. Please report those to the vendor. Best-practice findings with no demonstrated impact — missing headers, SPF/DKIM/DMARC records, version disclosure, self-XSS, and similar. Scanner output — raw automated scanner results without a working proof of concept. You're still welcome to send these our way for awareness, and we appreciate the heads up — but they won't qualify for rewards or points-based compensation. Credentials Accounts on all publicly facing targets can be self-provisioned. Please sign up for an account using your @ bugcrowdninja.com email address as they will be automatically approved and will allow for testing of all features without needing to make a payment. For more info regarding @bugcrowdninja email addresses, see here . Access/Traffic Identification Targets are accessible via the public internet. When accessing, please add the below request header. DDoS and Bruteforcing are highly discouraged and testing without the below header can lead to account blockage and IP ban since it will be considered a legitimate attack. Identifier │ Header │ Example Username │ X-Bug-Bounty: Bugcrowd- │ X-Bug-Bounty: Bugcrowd-proresearcher Cross-Domain Duplicate Policy Please note that bitso.com , nvio.mx , and nvio.ar are considered a single logical entity for the purposes of this program. Vulnerabilities identified on these domains that originate from the same underlying code, configuration, or database will be treated as a single finding. The first report received ( on any of these domains ) will be considered the original; subsequent reports on a sibling domain will be closed as Duplicate . Note: Researchers are encouraged to note if a vulnerability affects multiple domains within a single report. N-Day Policy When N-Day bugs are released to the public, we will consider these as in scope after 14 days have gone by e.g: N-day released on 01/01/2025, we would consider it in-scope on 01/15/2025 Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further. The Fine Print You must comply with all applicable laws in connection with your participation in this program. You are also responsible for any applicable taxes associated with any reward you receive. Thank you for helping keep the crypto community safe!

In Scope (in scope)

Bitso.com - Bitso is a cryptocurrency platform that enables users to invest, trade, and make borderless payments using digital assets. With over 8 million users globally, it offers a range of services tailored to both individuals and businesses. Key Features: Cryptocurrency Trading, Earnings Program, Investment Tools, Bitso Card, Business Solutions. Bitso Mobile - Currently the applications are being developed natively. Therefore they don't share codebase nor framework so all submissions will be considered unique for both apps on iOS and Android. Hackers are encouraged to use the applications version found in the App Stores. Apps - Bitso Wallet - The Bitso Wallet app allows users to manage their cryptocurrency investments, trade digital assets, and make payments directly from their mobile devices. Bitso Alpha - Bitso Alpha is a professional trading platform offered by Bitso, designed for users who require advanced tools and features for cryptocurrency trading.