Bolt Technology OÜ

Description

At Bolt, we're building a future where people don’t need to own personal cars to move around safely and conveniently. A future where people have the freedom to use transport on demand, choosing whatever vehicle's best for each occasion — be it a car, scooter, or e-bike. No technology is perfect and Bolt believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web and mobile applications. Good luck, and happy hunting! How does the program work? Security researchers and Bolt customers are encouraged to submit reports regarding the security measures used to protect Bolt products and services. Members of Bolt’s team may contact you to confirm that we have received your submission, ask questions about your findings, and discuss how to reproduce them. Bolt may direct you to stop your activities in the event that your research impacts Bolt-owned assets, Bolt vendors, or other customers. If directed to stop, you must immediately comply with the request. Timeline Note: Timeline as shown below is based on a submission which includes a fully detailed vulnerability with all of the required reproduction steps We aim to respond to submissions as fast as possible, according to the severity of the report. Bounty Payout : 5 business days from Bolt's validation (after Bugcrowd triage is completed) Response to Researcher Questions : 2 business days from blocker created for Bolt Please make sure your report includes a detailed description of the issue and the steps you believe may be required to reproduce what you have observed. A detailed description of the vulnerability and reproduction steps are required for each report. If you do not provide this information within 7 business days from the submission of the report, we will close the report as Not Applicable. Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Bolt not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Bolt, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation. Access & credentials: To gain access to the applications, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Rules of Engagement

1. Research must be done using your own Bolt account on products that you own.
2. You can not be a partner or an employee of Bolt to participate in this program.
3. You should not intentionally modify online accounts, data or products owned by other Bolt customers (without explicit permission). If during the course of your research, you find a vulnerability that would allow you to bypass an authentication control for another person’s account, you should report the vulnerability to Bolt immediately and take no further action.
4. If you are able to access or modify the personal data of other customers or other sensitive data that does not belong to you, immediately contact Bolt. Do not attempt to conduct post-exploitation work with this data.
5. Do not use or report findings from automated scanning tools.
6. Where you are able to access data that does not belong to you, you will be asked to delete it. You must comply with this request, demonstrate the steps you took to ensure it was deleted and confirm deletion to Bolt in order to be eligible for a reward.
7. Do not attempt to use brute force or denial of service attacks on Bolt-owned systems without prior written approval.
8. Do not engage in knowingly posting, transmitting, uploading, linking to, sending or storing any malicious software.
9. Be respectful when interacting with Bolt's staff. We may not answer you immediately because of the workload, but we do respond! Focus Areas: Bolt’s public-facing applications Authentication related issues Bolt applications and services which are connected to production environment Vulnerabilities in other applications owned by Bolt Focus on impact. Minor misconfiguration alone does not qualify for rewards. Excluded submission types P5 vulnerabilities Vulnerabilities that only work by tricking users into interacting with malicious content (e.g., phishing, vishing, smishing, malware or any other form of social engineering) Abuse of authentication workflows through automated or high-volume interaction without demonstrated high-impact. Clickjacking on pages with no data modification actions. Unauthenticated/logout/login CSRF. Attacks requiring MITM or physical access to a user's device. Previously known vulnerable libraries without a relevant Bolt related working PoC. SSL/TLS configuration best practice misses. Any activity that could lead to the disruption of service (DoS). Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS. SPF, DKIM, DMARC issues. Lack of Secure and HTTPOnly cookie flags (critical systems may still be in scope). XSS (or a behavior) where you can only attack your own account. XSS on pages where admins are intentionally given full HTML editing capabilities. Reflected file download. Physical security of the Bolts offices and employees. N-day/Third party 0-day Policy When N-Day bugs are released to the public, we will consider these as in scope after 14 days has gone by e.g: N-day released on 01/01/2025, we would consider it in-scope on 01/15/2025 Out-of-Scope Social engineering of Bolt staff. Third party applications or websites or services that integrate with, or link to the services of Bolt. Submissions regarding the test environment will not be accepted because this environment is essentially a playground for developers and is not connected to a live or staging environment. Stolen/Breached Credentials If you happen to identify vulnerabilities involving data that has been exposed or leaked such as dark web forums or leaked credential sites. You can report it to this engagement. However, be aware that it is only eligible for points-based compensation. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.