Block Open Source

Description

Block, Inc. This program is part of Block, Inc. You can participate in our other bug bounty programs below: Square Cash Tidal Afterpay Rewarding security bugs in our open source projects Block recognizes the important contributions the security research community can make. Part of keeping Block's customers safe is making sure that we find and fix any security issues in our open source projects. If you find any vulnerabilities in any of our participating open source projects, please submit a report. Even better, send us a fix! This program is to report issues in our open source projects. If you believe you have discovered a security vulnerability in one of Block's other product lines (squareup.com, square.com, cash.app, tidal.com, afterpay.com) or mobile applications (Square Point of Sale, Cash App, Tidal), please report them to the other bug bounty programs listed above. Attributes of a good report A well written, detailed explanation and proof-of-concept for the bug that’s easy to follow along. Include specific source code references for the issue from our GitHub organizations. Include repository, release version, branch and other information. Describe the real-world impact/exploitability of the bug. Ineligible reports Issues related to software that’s not within our control (such as external dependencies), not exploitable, and does not pose a significant risk to Block would not be eligible for a reward. Issues relating to outdated or insecure library versions we include. Most of our open source development is publicly visible. Reports related to an issue already being addressed in a branch or being tracked in a public way will therefore not be eligible for a bounty. Reports without a proof-of-concept or clear path to exploitation. Rules of Engagement Be sure to review the project’s README.md file for contributing guidelines before testing. If you are able to access or modify personal data of Block customers or other sensitive data, immediately contact Block - do not attempt to conduct post-exploitation work. Do not use, share, publish, or disclose information obtained in the course of identifying issues. After submitting you must delete, purge, and/or destroy all copies of information or digital samples. Do not attempt a denial-of-service attack. Do not use ChatGPT, Claude, DeepSeek, Google Gemini or any AI tools during your research. You may not disclose any information within these platforms. Please contact [email protected] for any escalations. Do not contact Block or Block aliases to follow up on submissions. Doing so can result in point reduction or program expulsion. How to send a fix Please do not open a pull request or GitHub ticket to fix an issue you're reporting. This would unnecessarily reveal any potential vulnerabilities. Instead, if you'd like to send us a fix, please submit a vulnerability report within the repository’s Security tab. Rewards Rewards range from $100 to $5,000 depending on the type of issue and impact. We prioritize and reward issues based on the real-world impact to our software and systems as operated by Block.

Targets

Target information Block maintains a set of Open Source Github Repositories that we consider to be in-scope for our Bug Bounty Program. In scope projects contain . a BUG-BOUNTY.md file in the root directory to specify they are in scope. Note that we only reward issues found in the latest main branch or release of a project. Outdated releases, development branches, pull requests, or similar are excluded from the bounty. Currently, the projects in scope are: Afterpay sdk-ios sdk-android Cash App cash-app-pay-ios-sdk cash-app-pay-android-sdk Hermit misk Square Wire Disclosure Procedures Block recognizes the important contributions the security research community can make. We do not publicly disclose vulnerabilities by default. We take the security of our services very seriously and monitor their use for indications of a malicious attack. In order to distinguish legitimate security research from malicious attacks against our services, we promise not to bring legal action against researchers who: Share with us the full details of any problem found Do not disclose the issue to others until we’ve had a reasonable time to address it and disclosure has been approved by us Do not intentionally harm the experience or usefulness of the service to others Never attempt to view, modify, access, disclose, exfiltrate, use or damage data belonging to Block, its customers, or others Do not attempt a denial-of-service attack Do not perform any research or testing in violation of the law

████████ (in scope)

██████████████████████████████████████████████████████████████