Braintree

Not accepted

• Any physical attacks against PayPal property or data centers
• Username enumeration on customer facing systems
• Scanner output or scanner-generated reports, including any automated or active exploit tool.
• Man-in-the-Middle attacks.
• Vulnerabilities involving stolen employee/consumer/merchant credentials or physical access to a device.
• Social engineering attacks
• Open redirection
• Host header injections without a specific, demonstrable impact.
• Vulnerabilities found through DDoS or spam attacks.
• Self-XSS, which includes any payload entered by the victim.
• Login/logout CSRF
• Content spoofing without embedding an external link or JavaScript.
• Issues related to SSL certificates.
• DNS configuration issues
• Server configuration issues (e.g. open ports, TLS versions, etc.)
• Vulnerabilities only affecting users of outdated, unpatched, or unsupported browsers and platforms
• Information disclosure of public or non-protected information
• Exposed credentials that are either no longer valid, or do not pose a risk to an in-scope asset.
• Vulnerabilities on third party libraries without showing specific impact to the target application
• Reports that involve secondary business accounts, and the impact is limited solely to the parent account.
• Denial of Service
• Vulnerabilities requiring a rooted, jailbroken, or otherwise modified device
• Exposure of non-sensitive data on the device
• Vulnerabilities requiring extensive user interaction