Cash App

Description

Block, Inc. This program is part of Block, Inc. You can participate in our other bug bounty programs below: Square Tidal Afterpay Block Open Source Serious about security Our approach to security is designed to protect the CashApp ecosystem. We monitor every transaction, continuously innovate in fraud prevention, and we protect our customers’ data like our business depends on it - because it does. We adhere to industry-leading standards to manage our network, secure our web and client applications, and set policies across our organization. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. A Note on Similar Submissions: We ask that researchers who are able to identify the same or similar types of issues in multiple locations across one of our applications combine those findings into a single submission that includes a description as well as the various locations where vulnerabilities have been identified. This greatly assists us in our triage process and allows us to process your submissions faster. The combined submissions will be evaluated holistically and will receive rewards corresponding to the collective findings. For example, if an application is discovered to have broken access control on a number of API endpoints, please submit a single submission that includes a list of those API endpoints. If separate submissions are made, they may be inadvertently closed as duplicates. Access Credentials are not provided for this engagement but feel free to self register using your @bugcrowdninja.com email address. Access to *.cashstaging.app is not provided, however, if you are able to hit the site and find vulnerabilities you are welcome to submit them here. The flags are long enough that brute force won't work. You'll have to be more creative! Rules of Engagement If you are able to access or modify personal data of Cash App customers or other sensitive data, immediately contact Block - do not attempt to conduct post-exploitation work. Do not use, share, publish, or disclose information obtained in the course of identifying issues. After submitting you must delete, purge, and/or destroy all copies of information or digital samples. Do not attempt a denial-of-service attack. Do not use ChatGPT, DeepSeek, Google Gemini or any AI tools during your research. You may not disclose any information within these platforms. Please contact [email protected] for any escalations. Do not contact Cash App, Block, or Block aliases to follow up on submissions. Doing so can result in point reduction or program expulsion.

Targets

Target Information Cash App for iOS : https://itunes.apple.com/us/app/cash-app/id711923939?mt=8 Cash App for Android : https://play.google.com/store/apps/details?id=com.squareup.cash Cash App for Web : https://cash.app Any finding or (sub)domain that is not listed in scope but is confirmed owned by Cash/Block may be accepted upon review. Rewards for these findings may differ and fall under the Subdomain Takeover rubric shown below. Focus Area: Authentication Flows In our commitment to maintaining the highest level of security and trust in Cash App, we are particularly interested in identifying and mitigating vulnerabilities that may affect the integrity of our authentication systems. We urge security researchers to concentrate their efforts on exploring and testing the robustness of our authentication flows, including but not limited to: Login Flows: Please focus on the mechanisms that enable users to gain access to their accounts, including multi-factor authentication, and any other methods supported by our platform. We are looking for vulnerabilities that could potentially allow unauthorized access or account takeover. Account Recovery Flows: Special attention should be paid to the processes that allow users to recover or reset their account access. This includes account recovery questions and factors, and the use of email, phone number or $CashTag for account identification. We aim to uncover any weaknesses that could be exploited to bypass these recovery procedures or to gain unauthorized access to user accounts. We encourage researchers to approach these areas with a creative and critical mindset, exploring potential vulnerabilities that could be exploited through various attack vectors. Our goal is to ensure that our authentication flows are not just compliant with industry standards, but are also as resilient as possible against emerging threats and sophisticated attack methodologies. Subdomain Takeovers Payouts for Subdomain Takeover findings differ from the rewards listed above. Please review the severity and descriptions below before submitting a report. Impact │ Severity │ Reward │ Description High Impact Subdomain Takeover │ P2 │ $2,500 │ Awarded for domains and subdomains with reputational or technical risk. Also for subdomains under a parent domain with reputational or technical risk, and access to sensitive data on that parent domain. Basic Subdomain Takeover │ P3 │ $250 - $500 │ Awarded for domains and subdomains under a parent domain with reputational or technical risk, but without access to sensitive data on that parent domain. Concession award │ P4 │ $100 │ Awarded for domains and subdomains that are owned by Block and have no risks except publicity risk (which is inherent in ownership). Info Stealer Logs Block is aware of credentials obtained from stealer log malware. While we encourage researchers to submit findings that impact Block or Block customers, we reserve the right to treat each submission and reward on a case by case basis. Payout may not align with our standard payout scheme. Program Exclusions Any target that is covered under another Block bug bounty program (e.g. Square, Block Open Source, Tidal, Afterpay) Square.online, square.links, square.site, and Weebly assets are considered out of scope for this program Any vulnerabilities found in Third-party software Any physical attempts against Square property or data centers Logout CSRF Presence of autocomplete attribute on web forms Missing cookie flags on non-sensitive cookies No maximum password length An oracle that discloses whether a given username, email address, or phone number is associated with an actual account. (However, please do submit anything that allows you to recover usernames en masse.) Enumeration of users is only considered valid for Square sites. Using spoofed emails for phishing Reports of the 2-factor token not expiring. We use TOTP codes for two factor. Do not attempt a denial-of-service (DoS) attack Cache poisoning resulting in DoS Public information that is Square customers but not specifically regarding Cash App Disclosure Procedures Block recognizes the important contributions the security research community can make. We do not publicly disclose vulnerabilities by default. We take the security of our services very seriously and monitor their use for indications of a malicious attack. In order to distinguish legitimate security research from malicious attacks against our services, we promise not to bring legal action against researchers who: Share with us the full details of any problem found Do not disclose the issue to others until we’ve had a reasonable time to address it and disclosure has been approved by us Do not intentionally harm the experience or usefulness of the service to others Never attempt to view, modify, access, disclose, exfiltrate, use or damage data belonging to Block, its customers, or others Do not perform any research or testing in violation of the law Submission Quality Detailed steps for reproducing the bug. If valuable, please include any screenshots, links you clicked on, pages visited, etc. We prefer detailed repro steps or video demos. Always include the linked account name, email address or SMS. Describe the versions of all relevant components of the attack (eg browser, OS, mobile app version). Describe a concrete attack scenario. How will the problem impact Cash or Cash customers? Put the problem into context and demonstrate with clear evidence. Please group related issues into the same report rather than submitting nearly-identical reports. For example, an authorization bypass might affect a handful of endpoints. Regarding Cryptocurrency Please submit any issues related to cryptocurrency to the Cash program immediately. Cash is eager to work with the community to make sure that every researcher finding related to cryptocurrency will be fairly rewarded given the vulnerability's impact on business and overall severity. This includes compensation that might be higher than what is advertised currently.