Luminor

Disclosure Policy

• Please do not discuss or disclose this program or any vulnerabilities (even resolved ones) outside of the program and keep them in full confidentiality without prior explicit written consent from Luminor Bank AS.
• Follow HackerOne's disclosure guidelines.

Program Rules

• Provide as much information as possible about the potential issue you have discovered with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
• Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact. When duplicates occur, we only triage the first report received (provided if it can be fully reproduced).
• Use your @wearehackerone.com Email Alias when signing up for any accounts so we can identify you as a security researcher.
• Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
• Social engineering (e.g., phishing, vishing, smishing) is prohibited.
• Make a good faith effort to avoid privacy violations (incl. any personal data protection breaches), destruction of data, and interruption or degradation of our service.
• Only interact with accounts you own or with explicit permission of the account holder.
• Ensure you are only testing on systems which are owned or operated by Luminor Bank AS, do not run any testing on third party systems
• Remove all Luminor Bank AS Confidential Information, including Personal Data you got from the analysis once the report is resolved.

All the following conduct is strictly prohibited:

• Social engineering (e.g. phishing, vishing, smishing).
• Physical attacks.
• Any testing that could harm our services or customers, including launching any large-scale automated attacks (e.g. denial-of-service attacks (DDoS)), Spam, pyramid schemes, or deployment or use any other malicious software or technology.
• Intentional conduct that deletes or alters user-generated data; impairs, disrupts, or disables systems; or renders data inaccessible.
• Violation of any laws, including Data Protection Laws, other officially binding rules or regulatory provisions, courts of law and administrative court judgements, such as codes of practice, public authority decisions, specifically but not limited to all competition, privacy, personal data protection and information security laws.
• Accessing, copying, modification, deletion, publishing or otherwise disclosing as well as making any other use or making advantage of any Luminor Bank AS information, including personal data of any kind.
• Including any Personal Data in the disclosed vulnerability report.
• Public disclosure of any Luminor Bank AS Confidential Information, specifically the details of the vulnerability, indicator of vulnerability, or the content of information rendered available by a vulnerability, except upon receiving prior explicit written authorization from Luminor Bank AS.
• Do not complete any fraudulent financial transactions or make financial transactions with other user accounts you do not own.

Out of scope vulnerabilities

** When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:**

• HackerOne Core Ineligible Findings
• Testing third-party applications, websites, or services that integrate with or link to Luminor Bank AS properties.
• Password and account recovery policies, such as reset link expiration or password complexity.
• Clickjacking without an impact.
• Known-vulnerable library (without evidence of exploitability).
• Certain reports of spam.
• Low impact host header issues.
• Tabnabbing
• Reports from automated tools or scans without a working Proof of Concept.
• Exposed credentials that are either no longer valid, or do not pose a risk to an in scope asset.
• Vulnerabilities only affecting users of outdated or unpatched browsers and platforms.
• Email/Username enumeration.
• Cookie and logout policies.
• Vulnerabilities which require a jailbroken device.
• API keys found in our mobile applications or any API key exposed without demonstrating proper security impact.
• Issues that require unlikely user interaction.

Testing

• Researchers should add headers to HTTP requests such as: X-HackerOne-Research: [H1 username]
• While you’re welcome to create accounts where they are available. We ask that you use your HackerOne alias when doing so. You can find instructions on how to find your alias here: https://docs.hackerone.com/en/articles/8404308-hacker-email-alias
• We’re unable to provide account licenses or refund expenses incurred during testing.
• Cautious testing of input forms or uploads: Identify your testing activities by including the strings “HackerOne-VDP-Testing"

Scoping

This program features an open scope, please try to classify your findings by type (iOS, Web, Android) and by country while submission. However, any IP address, website, API, mobile application or any other asset operated, owned or controlled by Luminor Bank AS is in scope.

Thank you for helping keep Luminor and our users safe!