DANA Bug Bounty Program

Rules

DANA

DANA Wallet is an e-wallet provider in Indonesia. It began operation in July 2017. DANA Wallet Indonesia's headquarter is in Jakarta, Indonesia.

Pay for anything & everything with just a tap of your finger. Experience the convenience of carrying out transactions with ease; from bills, e-commerce payments, to barcode scans in merchants. #GantiDompet now & switch to DANA Digital wallet for faster, safer & more practical payment methods.

Program Rules

Thank you for your interest in the DANA bug bounty program.

• We believe that no technology is perfect and that working with skilled security researchers is crucial in identifying weaknesses in our systems.
• If you believe you've found a security bug in our service, we are happy to work with you to resolve the issue promptly and ensure you are fairly rewarded for your discovery.
• Any type of denial of service attacks is strictly forbidden, as well as any interference with network equipment and DANA infrastructure.

Special Case (Up to USD $5000)

Eligible vulnerabilities include:

• Account Takeover (ATO), including the ability to use another user’s funds.
• Mass extraction of sensitive user data, such as identity information, unauthorized access to another user’s balance, account details, transaction records.
• Scraping and Automation Bypass Methods in critical application flows, such as login or registration.

Eligibility and Responsible Disclosure

We are happy to thank everyone who submits valid reports which help us improve the security of DANA, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability (see below).
• "OneFixOneReward": If two or more endpoints use the same codebase and a single fix can be deployed to fix all the different endpoints, only one endpoint will be considered as eligible for a reward and other reports will be closed as Informative. Regardless, such reports will be reviewed on a case by case basis.
• You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
• You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit yourself about requests per second).
• You must not leak, manipulate, or destroy any user data.
• You must not be a former or current employee of DANA or one of its contractor.
• Every report will be reanalyzed and the severity rating may be subject to change. Severity changes can be increased or decreased from initial report depending on the impact of a vulnerability.
• No full or partial vulnerability disclosure is allowed.
• XSS reports must demonstrate meaningful security impact, such as exposure of sensitive user data, access to a usable authentication credential, or an unauthorized action on another user’s account. Proof of JavaScript execution alone is insufficient for reward eligibility.

Testing Policy

Please test vulnerabilities only against your own accounts. Only use authorized accounts so as not to inadvertently compromise the privacy of our users.

• Avoid tests that could cause degradation or interruption of our services.
• Do not use automated scanners or tools that generate large amount of network traffic.
• Do not leak, manipulate, or destroy any user data or files in any system.
• Do not copy any files from the system and disclose them.

Known vulnerabilities

The following list are known vulnerabilities that are known from previous security testing. They are in the process of being fixed and will not be rewarded.

• Overly permissive Google API key in application binaries. This is known and will be fixed in a near future release
• Open Redirect on m.dana.id
• H5 JSBridge-related issues

In-Scope Assets

Core Products:

DANA Android Application https://play.google.com/store/apps/details?id=id.dana&hl=en

DANA iOS Application https://apps.apple.com/id/app/dana/id1437123008

DANA Web Application https://m.dana.id

Endpoint mgs.dana.id

Rewards Grid

Rewards are given based on CVSS scoring and actual business impact.

REPORTS OF LEAKS AND EXPOSED CREDENTIALS

In the context of this program, we do not accept or reward reports of leaks that are not applicable to our program’s scope and identified outside of our program’s scope.

Also, in order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behavior (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees/service providers. Eligible reports will be rewarded according to the "Core Product" reward grid.

This excludes, but is not limited to:

• Stolen credentials gathered from unidentified sources
• Exposed credentials that are not applicable on the program’s scope
• Exposed GitHub/GitLab (or similar) instance with no direct relation with our program’s scope
• Exposed secrets (e.g. API tokens/keys or other technical credentials) that are not directly related to the program’s scope
• Exposed PII on an out-of-scope asset

Out of scope

• webdev.dana.id
• wp.dana.id
• fiat.dana.id
• cmsdev.dana.id
• techops.dana.id
• dm.dana.id
• encrypt.dana.id
• *.dana.id
• Dev, Test, SIT, Staging, Sandbox, Demo, and other non-production environments

Qualifying vulnerabilities

• Business logic vulnerability with real security impact
• Authentication bypass & broken authentication
• Horizontal and vertical privilege escalation
• Code injections (HTML, JS, SQL, PHP, ...)
• Remote Code Execution (RCE)
• Cross-Site Scripting (XSS) with real security impact
• CORS with real security impact
• Cross-site Request Forgery (CSRF) with real security impact
• Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
• Insecure Direct Object References (IDOR)
• Sensitive Information Exposure through insecure data storage on device
• Bypassing Verification Methods

Non-qualifying vulnerabilities

• Lack of expiration on auth tokens
• Vulnerabilities affecting outdated versions - we only consider reports in the latest versions of our application that are currently in the Google Play/Apple Play Stores
• Exploiting a generic Android or iOS vulnerability
• Lack of encryption on internal database/preference files without real security impact
• Exploits that are only possible on a jailbroken device
• Denial of Service (DoS) attacks
• Self XSS
• "HTTP Host Header" XSS
• Missing cookie flags
• Mixed content warnings
• Lack of HTTP security headers (CSP, X-XSS, etc.)
• SSL/TLS best practices
• No rate-limiting enforced
• Clickjacking/UI redressing
• Software version disclosure
• Stack traces, path disclosure, directory listings, etc
• Physical or social engineering attempts like phishing
• Recently disclosed 0-day vulnerabilities
• Presence of autocomplete attribute on web forms
• Issues that require physical access to a victim's mobile device
• Logout and other instances of low-severity CSRF
• Missing security-related HTTP headers which do not lead directly to a vulnerability
• Reports from automated web vulnerability scanners (Acunetix, Vega etc) that has not been validated
• Incomplete or missing SPF/DKIM/DMARC on mail servers
• Security best practices without real security impact
• Attacks requiring MITM or physical access to a user's device
• Enumeration/account oracles: possibility to enumerate phone numbers, emails, GUID etc and receive indication that it exists
• Subdomain takeover which not included in main scope