Lime

Description

Welcome to Lime’s Bug Bounty program! Lime is an urban transportation leader that offers mobility services, including scooters and bikes. Our mission is to develop the most advanced micro mobility solution that empowers humans to take one step towards becoming carbon neutral. Lime has three customer profiles that we cater: Riders, this customer is using Lime products to commute from point A to point B. Operators, this customer makes sure our fleet of vehicles is always functioning to serve the riders. There are three major categories of operators at Lime: Operators: These people are Lime employees who perform in-warehouse tasks to repair and maintain the fleet Logistics Partner: This a contracting agency that Lime uses to partner with during peak season for fluctuating operational demands Juicers: These are independent contractors that perform out-of-warehouse tasks to get paid through the Juicer app Cities, this customer provides Lime the opportunity to serve the customers of that city. The city provides a region to Lime where they can operate in also provides certain requirements like No-operation zones(NOZ) [you might have noticed the speed of scooters and bike drop in certain areas], No-parking zones you might have seen dedicated parking spots in some cities], Safety requirements etc. They require Lime to submit heatmaps to help them in city planning along with other Government relations requirements. We're looking for passionate and driven researchers who are excited to join us in our pursuit of revolutionizing the way humans try to save the planet. With access to state-of-the-art technology and a highly collaborative team, you'll have the opportunity to explore groundbreaking ideas and make a real impact in this exciting and rapidly evolving field of micromobility. Lime values the work done by security researchers in improving the security of our products and service offerings. We are committed to working with this community to verify, reproduce, and respond to legitimate reported vulnerabilities. We encourage the community to participate in our responsible reporting process. We will coordinate and communicate with researchers through the bug bounty process. Good luck, and happy hunting! Eligibility Note that Lime's Bug Bounty program is in part facilitated through a third party (Bugcrowd) that performs additional services and eligibility checks on our behalf. For example, Lime may not issue payments if one or more of the following is applicable: You are a resident of a country under U.S. sanctions or live in a country that prohibits this type of program. You are currently (or were in the last 6 months) an employee of Lime, a Lime subsidiary, or a third-party contractor with access to Lime’s internal systems and networks. Ratings/Rewards For the initial prioritization and rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . Internally, Lime will use a CVSS 3.0 score to determine the severity of the vulnerability, the overall risk is determined by the Severity of the vulnerability, ease of exploitation, and business impact on Lime. The severity/Vulnerability rating only determines the “Severity of the vulnerability”. The overall risk rating can be different from the severity rating of the vulnerability. If the risk rating is reduced after Bugcrowd triage, the Lime security team will provide a detailed explanation as to why they made the change.

Targets

Active testing is only authorized on the targets listed as In-Scope. If you believe you have identified a severe vulnerability on a Lime system outside the scope, please create a ticket with Bugcrowd Support to inquire. Access Accounts can be provisioned where signup is available using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Some of the targets will NOT have a user signup or registration process. This means it is for internal use only. Targets have been divided into Public In-Scope, Private In-Scope, and Out-of-Scope. These targets represent the current state and may be moved from one category to another determined by Lime's security team. This program is dedicated to perceived online security issues that may affect many people on Lime. If you're having issues related to your individual account, please visit our Help Center . You can self-register for the Lime Rider/Juicer apps which are found on: App Store Google Play Rules of Engagement Research must be done using your own Lime account on products that you own. You should not intentionally modify online accounts, data or products owned by other Lime customers (without explicit permission). If during the course of your research, you find a vulnerability that would allow you to bypass an authentication control for another person’s account, you should report the vulnerability to Lime immediately and take no further action. If you are able to access or modify the personal data of other customers or other sensitive data that does not belong to you, immediately contact Lime. Do not attempt to conduct post-exploitation work with this data. Where you are able to access data that does not belong to you, you will be asked to delete it. You must comply with this request, demonstrate the steps you took to ensure it was deleted and confirm deletion to Lime in order to be eligible for a reward. Do not attempt to use brute force or denial of service attacks on Lime-owned systems without prior written approval. Focus Areas Lime's public-facing applications Vulnerabilities in other applications owned by Lime Vulnerabilities we don’t already know about The quality of a submission that makes Lime’s security engineers' job easier will result in a higher bounty in the category. Visual POC with code and video of screen share to reproduce Detailed attacker following MITRE attack framework Focus on impact. Minor misconfiguration alone does not qualify for rewards. For 0-day issues, we aim at patching within 30 days. Reports within 30 days of vulnerability release may not be rewarded. We have decided now that we will reward for CVEs with a score of 9.5 and higher if not patched within a week (5 business days) of being added to NVD or GHSA (Github security advisory). For vulnerability of a vendor (for example, Zendesk, Hubspot), please report to the vendor directly to avoid double reporting. Excluded Submission Types Cookie flags on webview.lime.bike "secret" keys exposed in iOS/Android builds that we do not consider secret Attacks that require unauthorized access to users' clients (phones, browsers, etc) Zero-day vulnerabilities (CVEs being added to NVD or GHSA (Github security advisory) with a score of 9.5 or lower) that are less than 30 days old. Android debugging enabled Lime account MFA issues are out of scope at the present time WAF bypass Open redirects / Lack of security speedbump when leaving the site (no immediate credential leak) Internal IP address disclosure Accessible Non-sensitive files and directories (e.g. README.TXT, CHANGES.TXT, robots.txt, .gitignore, WSDL, pprof, etc.) Social engineering / phishing attacks Self XSS Text injection Email spoofing (including SPF, DKIM, DMARC, From: spoofing, and visually similar, and related issues) Descriptive error messages (e.g. stack traces, application or server errors, path disclosure) Fingerprinting/banner disclosure on common/public services Clickjacking and issues only exploitable through clickjacking CSRF issues that don't impact the integrity of an account (e.g. log-in or out, contact forms, and other publicly accessible forms) Lack of Secure and HTTPOnly cookie flags (critical systems may still be in scope) Lack of rate limiting Login or Forgot Password page brute force, account lockout not enforced, or insufficient password strength requirements HTTPS mixed content scripts Username/email enumeration by brute forcing/error messages (e.g. login/signup / forgotten password) Exceptional cases may still be in scope (e.g. ability to enumerate email addresses via incrementing a numeric parameter) Missing HTTP security headers TLS/SSL Issues, including BEAST BREACH, insecure renegotiation, bad cipher suite, expired certificates, etc. Denial of Service attacks Out-of-date software Use of a known-vulnerable component (exceptional cases, such as where you are able to provide proof of exploitation, may still be in scope) Physical attacks against Lime's Facilities / Property / Assets Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.

Additional information

Responsible Disclosure Guidelines We will investigate legitimate reports and make every effort to quickly correct any vulnerability. To encourage responsible reporting, we will not take legal action against you nor ask law enforcement to investigate you, so long as you comply with the Terms. Do not access or modify data that does not belong to you. If you are able to gain access to or modify data that belongs to Lime, other customers, or Lime vendors during the course of your research, you must take the following actions: Immediately stop your activities, Disclose your findings to Lime as soon as possible (but no later than 24 hours after discovery). Your findings should include details of the vulnerability, including information needed to reproduce and validate the vulnerability and a Proof of Concept (POC), Wait for further instructions from the Lime team. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services. Give Lime a reasonable time to correct the issue before making any information public. In certain circumstances, Lime may request that you not disclose your findings or to delay disclosure until we can ensure that the matter has been adequately addressed. You may not disclose confirmed, unresolved vulnerabilities without approval from Lime.

Public In-Scope (in scope)

All of the below targets are publicly accessible. Accounts can be provisioned where signup is available. Some of the targets will NOT have a user signup or registration process. This means it is for internal use only. Lime Mobile Apps Our mobile applications allow you to manage on the go. The apps are available on Android and iOS, they are a single codebase. Any issues found on backend logic in Android will also be on iOS, and vice versa. Submissions will be duplicated when submitting to either device. Rider Application This is our primary customer-facing mobile application which riders use to ride Lime products. The application allows riders to manage their account, start/reserve rides, manage their Lime subscriptions, create support requests, and other tasks. The Android app uses Kotlin and Java and the iOS app uses Swift and Objective-C, powered by ruby on rails on the backend, running on Kubernetes cluster in AWS. Credentials can be provisioned in the user signup flow in the application Supply Application (Supply One) This is our primary operator-facing mobile application which operators use to perform operational tasks to keep the Lime fleet operational. The users of this application are Juicers and Logistical partners. The application allows operators to manage their account, perform out-of-warehouse tasks, manage their payment of how Lime pays them, provides a learning center of how to perform tasks, etc. The Android app uses Kotlin and Java and the iOS app uses Swift and Objective-C, powered by ruby on rails on the backend, running on the kubernetes cluster in AWS. Credentials can be provisioned in the user signup flow in the application. Lime API testing Web-production API (lime.bike) This API is our primary backend API. It is a RESTful API. This acts as the brain of all Lime applications. These APIs serve all the features of Lime applications described above. This is developed in Ruby on Rails. External API (lime.bike) This API is our subset of backend APIs. It is a RESTful API. This endpoint serves Government relations requirements and Uber integration features. These APIs serves all the features of Admintool GR features and Uber app serving Lime riders. This is developed in Ruby on rails. external-api.lime.bike = Uber integration API Data.lime.bike = Government relations features API Lime Bike communication Proxy platform This is a centralized and unified IoT Message communication between bikes and backend workflow. It is an independent and isolated IoT parser service to consolidates different types and formats of device messages into same format web-message , web-message-high = Bike communication

Private In-Scope (in scope)

All of the below targets are not publicly accessible. Accounts can be provisioned where signup is available. Some of the targets will NOT have a user signup or registration process. This means it is for internal use only. Please DO NOT email Lime to create test accounts for these endpoints. Lime Mobile Apps Ops application (iOS only) This is our operators' mobile application which operators use to perform operational tasks to maintain the Lime fleet. The users of this application are Operators(FTE) and Lime full-time employees(FTE). The application allows operators to manage their accounts, perform in-warehouse tasks, manage their payment of how Lime pays them, provide a learning center of how to perform tasks, etc. This app is only available on Lime company-owned devices and Lime FTE devices. iOS app uses Swift and Objective-C, powered by ruby on rails on the backend, running on the kubernetes cluster in AWS. Credentials CANNOT be provisioned in the application. Lime Web Apps Admintool Web application This is our main management application which Lime employees use to configure settings of all three customer profiles. The users of this application are Lime full-time employees(FTE) and Government relations personnel of the Lime markets. The app uses Typescript and Javascript, powered by ruby on rails on the backend, running on Kubernetes cluster and served from an S3 bucket in AWS. Credentials CANNOT be provisioned at in the user signup flow of the application LP dashboard web-application This is our management application which logistical partners use to onboard contractors to the Supply One app. The users of this application are Logistical Partner power users. The application allows LPs to manage their contractors, assign out-of-warehouse tasks to contractors, manage their payment, see Live maps of tasks, performance insights, and task forecasting. The app uses Typescript and Javascript, powered by ruby on rails on the backend, running on Kubernetes cluster and served from an S3 bucket in AWS. Credentials CANNOT be provisioned in the user signup flow of the application Data Portal This is our data portal application which Lime full-time employees use to view data insights to power their decision making. The users of this application are Lime full-time employees. The application allows Lime employees to share custom dashboards, insights, and queries to corroborate their decision-making. The app uses Vue, typescript, javascript, CSS, and shell scripts. Credentials CANNOT be provisioned in the user signup flow of the application. Inhouse deployment pipeline The users of this application are Lime full-time employees(developers). The application allows us to manage deployments, jobs, migrations, and sandboxes at Lime. The app uses Python, HTML, Javascript, CSS, and shell scripts. Credentials CANNOT be provisioned in the user signup flow of the application. Lime website Website, though this is public but the main functionality resides on mobile applications. The users of this application are the general public. The application allows us to share information with the public. The app uses Twig, PHP, HTML, JavaScript, and CSS. Credentials CANNOT be provisioned in the user signup flow of the application. Lime GPT The users of this application are Lime full-time employees. The application allows us to use GPT-based AI methods for multiple applications including our internal knowledge chatbot, translations, feedback analysis, and photo verification. The app uses Python, streamlit, and OpenAI APIs. Credentials CANNOT be provisioned in the user signup flow of the application. Lime API testing Help.lime.bike: FAQ for Lime applications help center ops.lime.bike = Ops application juicer.lime.bike = LP dashboard admintool.lime.bike = Admintool application

Out-of-Scope (out of scope)

Out-of-Scope Targets (Wildcard Rule) All wildcard ( * ) endpoint entries indicate that any endpoint not explicitly listed as In-Scope is considered Out of Scope . For example: *.lime.bike is listed as Out of Scope web-production.lime.bike and admintool.lime.bike are explicitly listed as In Scope In this case: Only web-production.lime.bike and admintool.lime.bike are authorized for testing All other lime.bike subdomains and endpoints are Out of Scope In general: Any endpoint explicitly listed as In Scope is authorized for testing Any endpoint not explicitly listed as In Scope should be treated as Out of Scope , even if it shares a common domain or parent wildcard If you are unsure whether a specific endpoint is in scope, do not test it . Please contact Bugcrowd Support for clarification before proceeding.