Magic Labs Managed Bug Bounty Engagement

Description

Magic is a developer SDK that empowers applications with passwordless authentication using magic links, WebAuthn, OAuth, and other authentication tools. Magic also builds a robust and distributed key management solution that supports this authentication infrastructure. As part of Magic's mission and security=overview , we want to improve the developer experience of authentication, while keeping security top of mind for all developers. We recognize the importance of maintaining security in our services in order to keep our users safe. With this bounty program, we encourage researchers to discover security vulnerabilities in our systems. These can cover almost any aspect of the product, from SDKs, APIs, public-facing codebases, user interfaces, developer dashboards, and more. Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Magic Labs not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Magic Labs, you can report it here. However, be aware that it is ineligible for rewards or points-based compensation. Engagement Guidelines Potential post-exploitation scenarios: If you believe you've identified a vulnerability that may lead to post-exploitation activity including modification or destruction of data please stop testing and submit your finding. We will work with you to evaluate the vulnerability and award you accordingly for the final impact and severity You are testing on production. Behavior that compromises the stability and integrity of the target(s) is out of scope. For example, do not target other users' data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced). Multiple vulnerabilities caused by one underlying issue will be awarded one bounty. Report Guidelines Reports must contain a clear explanation of the issue and the security impact along with detailed steps to reproduce it. If the issue cannot be reliably reproduced based on your report, it may be considered ineligible for a reward Do not submit more than one vulnerability per report. In cases where demonstrating impact requires chaining multiple vulnerabilities together, those can be included in the same report as long as the linkage is clearly explained We do not accept reports that contain low-effort or AI-generated content. Submissions must demonstrate original analysis, clear understanding of the issue, and actionable detail. Reports lacking meaningful human input will be rejected Response Guidelines Magic will make a best effort to meet the following response targets for researchers participating in our program: Time to first response (from report submit) - 5 business days Time to triage (from first response) - 3 business days Time to remediate - Dependent on severity and complexity Time to bounty (from triage) - 10 business days We will try to keep you informed about our progress throughout the process. Access The application is publicly accessible. Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here. When users want to sign up or log in to an application, the typical flow is: User enters email address User receives an email with a call to action (OTP code, magic link or additional methods) User verifies email address by responding to the call to action User is logged into the application Focus Areas To support your testing, we’ve highlighted several key areas of interest. While we ask that you report any efforts related to these areas, please note that testing is not limited to them. Submissions outside of these focus areas are equally welcomed and appreciated. Developer’s and user’s sensitive or personal information Asset or Platform security Key Management systems New / Beta features N-day/Third party 0-day Policy When N-Day bugs are released to the public, we will consider these as in scope after 14 days has gone by e.g: N-day released on 01/01/2025, we would consider it in-scope on 01/15/2025 Leaked Credentials Submissions related to leaked or exposed credentials (e.g., dark web forums, credential dumps) will be reviewed on a case-by-case basis if they are tied to a security vulnerability (i.e. bypassing protected actions, or causing harm to our end users and customers). The use of any leaked credentials during testing is strictly prohibited and may result in disqualification from the bounty program. Excluded Submission Types P5 vulnerabilities Availability/volumetric testing e.g.: DoS/DDoS/Network DoS Rate limiting bypass attempts Email bombing or flooding ALL forms of social engineering Previously known vulnerable libraries without a working Proof of Concept Non-security-impacting UX issues Email security records Man-in-the-Middle attacks Ability to abuse any existing blockchain functionality Features/links that lead to or are provided by external providers i.e our Typeform integrations, docs.fortmatic.com?ref=h1, etc. Race conditions are out of scope unless they result in: Unauthorized transfer or theft of user funds/crypto assets Exposure of private keys, credentials, or other sensitive data Disclosure Requirements As part of the Magic Bug Bounty Program, researchers may not discuss, share or disclose the program or any vulnerabilities (even resolved ones) outside of the platform without express consent from the organization Researchers may not profit from any discovered vulnerabilities or report vulnerabilities with conditions, demands or ransom threats Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via our Freshdesk Portal before going any further.

█████████ (in scope)

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████