FIS

Description

Introduction No technology is perfect, and as the threat landscape evolves, it becomes increasingly important for organizations to secure their assets. FIS believes that working with skilled security researchers across the globe is an integral part in keeping our businesses and customers safe. By researchers proactively identifying vulnerabilities in FIS application environments, it will aid in enhancing our overall security posture and enable us to better protect our customers and their data. We are excited for you to participate as a security researcher and help FIS become more secure. Good luck, and happy hunting! Policy FIS looks forward to working with the security community and appreciates the time and effort researchers put towards our program. FIS will make a best effort to respond to incoming reports within 5 business days and make a bounty determination after validating a legitimate security issue within 10 business days. We will try to keep researchers informed about our progress throughout the process. FIS has defined a list of general program rules, as well as rules regarding specific circumstances. Researchers must adhere to the stated rules and are encouraged to review all the rules presented in this brief. Any rule violations could potentially deem a submission ineligible for reward. While scope is covered in more detail in the program rules, it's worth noting that FIS is a large service provider. There are many applications that we provide hosting or support services for, but we don't always own those assets. Depending on the specific situation, submissions may be deemed out of scope for this reason. Additionally, when FIS publicly announces we are divesting an existing business asset, we will no longer accept any Bug Bounty submissions on the asset. If you have questions regarding scope, feel free to contact Bugcrowd Support Portal to confirm asset ownership. Our program evolves over time, so researchers are also encouraged to periodically review this program page for any rule changes. Researchers should also visit the Announcements page for program notifications. Important Announcements This section highlights key program announcements for your reference. This section will update periodically as program conditions change.

1. Do not submit any reports containing Personally Identifiable Information (PII). Some examples of PII include the following: Social Security Number Name Address Email address Phone number Etc. Screenshots may be included in submissions, but any PII data must be redacted. Any report with PII will be closed and not paid out.
2. Targets that achieve $50,000.00 in rewards within a 30-day period are still subject to scope removal for internal evaluation. However, any valid reports submitted before scope removal will still be eligible for payout. If you have any questions, please reach out to Bugcrowd Support Portal .
3. There are multiple program rules regarding credentials, and we encourage researchers to review these rules prior to submitting reports to the program. For example, we do not accept reports where credentials were guessed/brute forced, and we do not accept reports for leaked credentials (e.g., Github, dark web, etc.).
4. Third-Party / Vendor-Dependent Vulnerabilities When a vulnerability meets the following criteria, the report may be subject to non-payment, or a reduced reward (up to 10% of the standard payout): The vulnerability exists within vendor-owned code or infrastructure The vulnerability is not the result of FIS running an outdated or unsupported version The vulnerability requires vendor engagement for remediation
5. Write Actions in Production Environments Researchers must not perform write actions or make any changes in production environments, unless the write actions or changes are against records created by the researcher for testing purposes. Examples include (but are not limited to): Creating, modifying, or deleting data Changing account settings Triggering state changes Uploading executable or active content If you think you've discovered a vulnerability that enables write access or modification capabilities, and you're unable to create your own record to test against, pause testing and reach out to Bugcrowd Support Portal .
6. File Upload Testing When evaluating file upload functionality, avoid excessive upload attempts. Once a single, successful proof of concept (PoC) is achieved, discontinue further uploads, and submit your report. A clear and concise PoC is sufficient for validation. File uploads beyond what's necessary may introduce avoidable risk and could affect reward eligibility. Additionally, if you upload/write a file to a system, include your Bugcrowd username in the file name (e.g., tester123_poc.txt). This will assist in deconflicting logs and traffic. Program Rules Traffic Identification In an effort to assist in deconflicting logs and traffic, we are heavily enforcing a new rule on our program. Effective immediately, please include the following custom header in any testing activity against FIS assets: X-Bug-Bounty: Bugcrowd- "Testing activity" includes any requests sent to an FIS asset, be it automated or manual testing. The ability to deconflict Bug Bounty traffic will assist us when we are reviewing reports and activity. It will also minimize the potential for business impact. Failure to include the "X-Bug-Bounty" header, or failure to set the header in the specified format, will result in payment being reduced by 75%. Repeat failures to adhere to this rule may result in non-payment. Remote Code Execution (RCE) Submissions If you have identified and exploited a Remote Code Execution vulnerability, you must submit the report for this finding within three hours of exploitation. Additionally, only non-intrusive demonstrations of impact will be allowed, unless we have granted explicit permission to do otherwise. Non-intrusive demonstrations of impact are as follows: Outbound DNS request (e.g., nslookup [yourDomain]) Directory listing (e.g., dir, ls, pwd) Echoing the hostname (e.g., hostname) Echoing the current user (e.g., whoami) Echoing some text (e.g., echo BugBounty) Failure to adhere to these rules will result in a reduced payout of 75%, or potentially no payment for the submission. If you have any questions, please reach out to Bugcrowd Support Portal . Account Take Over (ATO) Submissions If you have identified a potential Account Take Over vulnerability that would affect FIS customer or client accounts, do not proceed in taking over the account. Please reach out to Bugcrowd Support Portal and request instructions for how to proceed. Failure to do so may result in the submission not being accepted, as we cannot allow disruptions to our customers and clients. Automated Tooling Requests Any automated tooling requests must be capped to a maximum of 5 requests per second. Researchers must not exceed the 5 requests per second limit at any time. Failure to do so may result in submissions not being accepted, as we cannot allow disruptions to our customers and clients. Additional Rules See the "Application Access" section for rules on authenticated testing. Do not publicly disclose a bug. Do not perform any testing that causes degradation to FIS or customer assets (e.g., Denial of Service (DoS), heavy automated scanning, etc.). Impacting our customers or customer data without our explicit approval is strictly prohibited. Researchers cannot utilize valid end-user credentials for any purpose. This is for legal and privacy compliance. No brute forcing/guessing log in credentials. This includes, but is not limited to, PINs/tokens for MFA, password resets, or other functionality that utilizes PINs/tokens for the purpose of authenticating a user. Data exfiltration is strictly prohibited. Researchers cannot purchase a service or request a product demo and then utilize any provisioned credentials for testing purposes. We reserve the right not to pay bounties for security bugs found in sites that are not on a product, service, or piece of infrastructure owned, operated, or maintained by FIS or any FIS-acquired entity. For example, assets that are 3rd party hosted, 3rd party owned, or 3rd party supported may be considered out of scope. If you have questions regarding scope, please contact Bugcrowd Support Portal . We reserve the right not to pay bounties for security bugs in or caused by additional third-party software (e.g., binary plugins, extensions, etc.). If you have questions regarding scope, please contact Bugcrowd Support Portal . Vulnerabilities are only eligible if they have not been previously discovered by our normal scanning tools, penetration tests, or other processes and sources. Vulnerabilities must be exploitable directly from the internet. Vulnerabilities eligible for payout must be unauthenticated or discovered with default or self-registered credentials. If you identify and utilize default credentials for an application, you must also indicate where the default credentials were discovered (e.g., vendor documentation, config file, etc.). FIS/WP Employees and contractors may not participate or collaborate on any FIS managed bug bounty program. Any vulnerabilities that use credentials obtained by means other than intended self-registration will be subject to a reduced payout. Any proof of concepts should not include images or statements that could cause reputational damage to FIS or its customers (e.g., brand damage or tagging on takeover pages). Multiple instances of the same application and vulnerability combination are only eligible for a single payout. If you have identified a single vulnerability affecting multiple endpoints that can be addressed with a single fix/remediation, please submit a single finding listing all those endpoints. We will individually review each endpoint and assess the eligible payout. In cases where there is shared code between multiple assets, bounties will only be paid for one instance of a vulnerability, as only one fix will need to be implemented in the shared code base. The following actions are forbidden on internal FIS systems: Internal pivoting Scanning Vulnerability exploitation If you have identified a Remote Code Execution (RCE) or similar vulnerability, please feel free to contact Bugcrowd Support Portal and determine the best way to demonstrate a safe proof of concept. Social engineering (e.g., phishing, vishing, smishing, etc.) is strictly prohibited. Please provide detailed reports with reproducible steps. Reports without sufficient details to reproduce the issue will not be eligible for a reward. Any potential or theoretical vulnerabilities that are mentioned without demonstration of exploitability will not be paid out. Exploitations must remain within the guidelines of our scope and program rules. Submit one vulnerability per report, unless you can chain the vulnerabilities. When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced). Post-authentication vulnerabilities are much more likely to have internal duplicates and single core fixes. Priority and payment are based on the environment (e.g., production, UAT, development, etc.), the vulnerability, and an internal analysis of the asset and relevant data. Any report leveraging archive engines (e.g., urlscan.io, web.archive.org, or similar sites) must demonstrate an in scope finding. For example - utilizing leaked tokens, API keys, or application data to demonstrate read/write access to an application. When FIS acquires a company, that company’s assets are not automatically in scope for the FIS Bug Bounty program. Those assets will not be considered in scope until we send an announcement indicating that they are now in scope. Reports submitted against those assets prior to the announcement will not be honored. Sensitive Data Once sensitive data (e.g., PII, financial information, etc.) is identified, immediately halt your activity, purge related data from your system, and report the finding to FIS. If PII is discovered, indicate the type of PII in the report (e.g., Social Security Number, name, address, etc.). Do not submit any reports with PII. Any report with PII will be closed and not paid out. Out of scope vulnerabilities When reporting vulnerabilities, please consider the following: The attack scenario. The exploitation potential of the vulnerability. The security impact of the vulnerability. The following issues are considered out of scope and are not included within our program: Mobile application vulnerabilities Reflected and DOM Cross-Site Scripting (XSS). Social engineering-based attacks (e.g., getting a user to click an attacker-controlled link). Subdomain Takeovers. Denial of Service, Rate Limiting, or Spamming issues (e.g., layer 7 DOS attacks, Slowloris, etc.). Clickjacking on pages with no sensitive actions. Cross-Site Request Forgery (CSRF). Man in the Middle (MITM) attacks. Attacks requiring physical access to a user's device. Vulnerabilities that require privileged access to a victim's device. Previously known vulnerable libraries without a working proof of concept. Comma Separated Values (CSV) injection. Content spoofing or text injection (e.g., HTML or CSS injection). IFRAME injection. Reports from automated tools or scans without accompanying demonstration of exploitability. Software version disclosure without accompanying demonstration of exploitability. Use of a known-vulnerable library without evidence of exploitability. Open redirects. Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), or Domain-based Message Authentication Reporting and Conformance (DMARC) record issues. Missing best practices. Insecure SSL or TLS issues (e.g., ciphers, certificates, etc.). User existence or enumeration vulnerabilities. Password or account recovery policies (e.g., reset link expiration, password complexity, etc.). Any physical attempts against FIS property or data centers. Missing or misconfigured security headers (e.g., HTTP Strict-Transport-Security (HSTS), Content Security Policy (CSP), etc.) that do not lead directly to a vulnerability. Presence of the “autocomplete” attribute on web forms. Host header injections unless you can show how they can lead to stealing user data. Insecure cookie settings for non-sensitive cookies. Vulnerabilities affecting users of outdated browsers or platforms. Issues related to software or protocols not under FIS control. Issues related to descriptive or verbose error messages. Vulnerabilities in third party applications that make use of an FIS API. Recently disclosed zero-day vulnerabilities. Please see the announcement regarding this. We will reward 10% of the payout within the first 14 days from the vendor releasing a patch, or the full amount after 14 days. Flash-based vulnerabilities. ALL Github and Postman leaks. Any kind of credentials leak. Any submissions from urlscan.io, web.archive.org, or similar sites that merely shows information being cached (e.g., name or email from a form submission). Any reports of vulnerabilities on domains in the " Out of Scope " list will be closed as N/A and will not qualify for a bounty. Public Disclosure Please do not discuss this program or any vulnerabilities (including resolved vulnerabilities) outside of the program without express consent from FIS. FIS strictly prohibits the discussion or disclosure of reports outside of the researcher that submitted the report, BugCrowd, or FIS. Internal Duplicates Due to alternate means of vulnerability discovery (e.g., scanning, penetration tests, etc.), there will be some vulnerabilities that we're already aware of. We will work to be as transparent as possible should you file a duplicate to an internal issue. Application Access Please review the following points regarding application access: FIS does not provision accounts for testing. FIS does not condone the sharing of credentials. FIS reserves the right to not pay bounties on reports found to be using valid end-user credentials. Researchers are forbidden from soliciting credentials from FIS clients, including the customers of FIS clients. Any vulnerabilities that use credentials obtained by means other than self-registration will be subject to a reduced payout. Wherever possible, researchers should include 'Bugcrowd Bug Bounty' in plaintext to allow our SOC team to deconflict logging data. Access from Digital Ocean IPs may be restricted. Access from non-US IPs may be restricted. Note: Please ensure that any FIS site you're testing actually belongs to FIS. Reviewing SSL certs, whois records, and DNS entries are potential ways to determine ownership. Please do not rely on Wikipedia to confirm what companies FIS has acquired. If you have any concerns about whether or not an asset belongs to FIS, please reach out to Bugcrowd Support Portal . FIS provides a wide range of financial products and services, including web development, application hosting, and DNS services. As such, there will be a number of sites where FIS only owns a section of them. There will also be situations where we host the site and own the domain but are not contractually responsible for the security of that site. We strive to be as transparent as possible with our bug bounty community. If a report comes in that meets this criteria, we will work with the researcher to determine the best path forward, which may include engaging the customer or client.

Targets

Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy. Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls. Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy. Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support Portal before going any further.

Out of Scope (out of scope)

Unless a return to scope date is explicitly specified, the following assets are considered indefinitely out of scope: creditportal.arvest.com applicant.bankofeastman.com applynowportal.bankIowa.com MyLoanPortal.commercebank.com portaldev.fisglobal.com loanapps.fcbca.com oaportal.fnbgranbury.com applicationportal.icbc-uscards.com portal.orientalbank.com myloanportal.plainscapital.com portaltest.fisglobal.com applicantportal.primesouth.com apply.riverwindbank.com loanportal.troybankandtrust.com loanportal.bankwithunited.com lendinghfs.hatborofed.com loans.collinsstatebank.com loans.fmberlin.com loans.hickorypointbank.com loans.pattersonstatebank.com lending.tristar.bank idmt2.fisglobal.com idmt3.fisglobal.com loans.bankoffrankewing.com Credit.arvest.com apply.mysunwest.com applynow.bankiowa.com oaloans.fnbgranbury.com apply.bankwithunited.com applyonline.fcbca.com oa-prod-orig.fisglobal.com oa-prod-cde.fisglobal.com oa-prod-flo.fisglobal.com oa-prod-flo-noap.fisglobal.com creditcards.icbc-uscards.com apply.Orientalbank.com applynow.primesouth.com loanapp.riverwindbank.com myloan.plainscapital.com myloan.commercebank.com aplica.orientalbank.com loanapp.troybankandtrust.com oa.fisglobal.com apuat-arvest.fisglobal.com apuat-bankiowa.fisglobal.com apuat-commerce.fisglobal.com apuat-fcbca.fisglobal.com apuat-fnbgranbury.fisglobal.com apuat-icbc.fisglobal.com ID-UAT2.fisglobal.com apuat-plainscapitol.fisglobal.com apuat-primesouth.fisglobal.com ap-uat3.fisglobal.com ID-UAT1.fisglobal.com apuat-riverwindbank.fisglobal.com apuat-troybankandtrust.fisglobal.com apuat-unitedbankshares.fisglobal.com id-uat.fisglobal.com (Testing for the out-of-scope instances above can be done on these sites only!--> oa-beta.fisglobal.com/oa/fi/10177, oa-qa.fisglobal.com/oa/fi/10349, qat3-InternetDirect.fisglobal.com, qat5-internetdirect.fisglobal.com, qat12-internetdirect.fisglobal.com, qat7-internetdirect.fisglobal.com, qat8-internetdirect.fisglobal.com, qat9-internetdirect.fisglobal.com, qat11-internetdirect.fisglobal.com) The assets below are also out of scope: payrix assets (effective 3/7/2023) sedgwick assets sungard availability services assets All Github/Postman Repos .automatedfinancial.com app.fisglobal.teamsupport.com (any and all apps/FIS instances relating to 3rd party owned and hosted TeamSupport application) .internet-estatements.com brandzone.fisglobal.com - this asset is owned/hosted and managed by a 3rd party. Worldpay assets are OOS as Worldpay is not an FIS owned entity. fisprotects.fisglobal.com & protect.fidelityifs.com (Issueless Positive Pay) WSO2-based applications and services na-adeptiaportal.fisglobal.com (any and ALL FIS instances/environments that are adeptia) rdocs.fisglobal.com, relius.net, yourbenefitaccount.com, accountplanaccess.com (Relius is OOS, all instances and environments.) *.avantgardportal.com, *.ebam.myfis.cloud, *ebam.fiscloudservices.com (AvantGard is OOS, all instances and environments) woseforms.fisglobal.com (effective 3/16/2026 any and all instances of woseforms.fisglobal.com is OOS. This will be OOS indefinitely as this application is owned, hosted, and managed by a 3rd party) FIS IdP Codebase/Assets Regulatory University assets (e.g., .regulatoryu.com) franklintempleton.canadaaccounts.ca, and franklintempleton.ca-onlineaccounts.ca (all instances and environments) (OOS until 12/01/2026) *-scm.fisglobal.com and *-ecm.fisglobal.com assets (All instances and environments of SCM and ECM assets are OOS effective 9/3/2026 - 11/15/2026) *.fiswebdev.net (All instances and environments of DNN assets are OOS effective 8/19/2026 - 11/15/2026) fis-portal-fundstransferagency.fisglobal.com (All instances and environments of the FIS TA assset)