Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Majid Al Futtaim Properties

Bug bounty on Bugcrowd maf.ae

Accepting reports Full safe harbor
Go to program
Top reward
$2,600
Top severity paid
Critical
Assets in scope
24
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $2,600
for critical bugs, from $150.
Report on Bugcrowd
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Public disclosure allowed
You may publish your report.

Rewards

What Bugcrowd lists as the payout for each severity.

Severity Reward
Critical $2,500 from $1,500
High $1,500 from $1,200
Medium $750 from $150
Safe harbor
Partial Testing is only authorized on the targets listed as In-Scope. Any domain/property of Majid Al Futtaim Properties not listed in the targets section is out of scope.

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Earlier reward tables (1)
  • 11 Nov 2026 to 11 Nov 2026: Critical up to $2,500

Scope

24 assets you may test.

Web 11

  • https://atjunction.com
  • https://citycentredeira.com
  • https://ecoupon.maf.ae
  • https://partnerconnect.maf.ae
  • https://smbu.mafcms.com/Sitefinity/adminapp/renderer/dashboard
  • https://www.citycentremalls.com/en
  • https://www.ghafwoods.com/en
  • https://www.majidalfuttaimproperties.com/en
  • https://www.malloftheemirates.com
  • https://www.mycitycentrealbarsha.com
  • https://www.tilalalghaf.com/en

Android apps 5

  • https://apps.apple.com/in/app/mall-of-egypt-official-app/id1441905105
  • https://play.google.com/store/apps/details?id=com.belongi.citycenter&hl=en_IN
  • https://play.google.com/store/apps/details?id=com.belongi.moe
  • https://play.google.com/store/apps/details?id=com.maf.communities&hl=en-US
  • https://play.google.com/store/search?q=mall+of+emirates&c=apps&hl=en_IN

iOS apps 5

  • https://apps.apple.com/app/mall-of-the-emirates-moe/id1449578693
  • https://apps.apple.com/in/app/city-centres/id1448471823
  • https://apps.apple.com/in/app/mall-of-egypt-official-app/id1441905105
  • https://apps.apple.com/in/app/mall-of-the-emirates-moe/id1449578693
  • https://apps.apple.com/us/app/belong-by-maf/id6443736108

APIs 3

  • https://api.mafshoppingmalls.com
  • https://maf-properties-prod.apigee.net
  • https://smbu-api.maf.ae

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Majid Al Futtaim Properties (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.

While testing

  • Do not modify data residing in an account that does not belong to you.
  • Do not access or download data beyond the minimum required to demonstrate a vulnerability.
  • Do not attempt to execute actions that disrupt the availability of our systems (e.g. any volumetric or denial of service attacks).
  • Do not post, transmit, upload, link to, send, or store any malicious software.
  • Do not test in a manner that would result in the sending of unsolicited or unauthorized junk mail, SMS, spam, or other forms of duplicative or unsolicited messages.
  • Do not test in a manner that would degrade the performance or operation of any system.
  • Do not test third-party applications, websites, or services that integrate with or link to our systems.
  • Do not make any changes to the system configurations, files, or data.
  • Do not introduce a backdoor in any system.
  • Do not in any way attack/interact with our end users.

Not accepted

  • Do not report any DMARC related issue for any in-scope domain.
  • Credential leak reports are appreciated, but they are not eligible for reward.

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 56 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Status

    Program status changed

  2. Status

    Program status changed

  3. Scope added

    https://play.google.com/store/apps/details?id=com.belongi.citycenter&hl=en_IN

  4. Scope added

    https://apps.apple.com/in/app/city-centres/id1448471823

  5. Scope added

    https://apps.apple.com/in/app/mall-of-egypt-official-app/id1441905105

  6. Scope added

    https://apps.apple.com/in/app/mall-of-the-emirates-moe/id1449578693

  7. Scope added

    https://play.google.com/store/search?q=mall+of+emirates&c=apps&hl=en_IN

  8. Scope added

    https://www.citycentremalls.com/en

  9. Scope added

    https://smbu-api.maf.ae/

  10. Scope added

    https://maf-properties-prod.apigee.net

  11. Scope added

    https://play.google.com/store/apps/details?id=com.maf.communities&hl=en-US

  12. Scope added

    https://apps.apple.com/us/app/belong-by-maf/id6443736108

  13. Scope added

    https://smbu.mafcms.com/Sitefinity/adminapp/renderer/dashboard

  14. Scope added

    https://www.majidalfuttaimproperties.com/en

  15. Scope added

    https://www.ghafwoods.com/en

  16. Scope added

    https://atjunction.com/

  17. Scope added

    https://www.tilalalghaf.com/en

  18. Scope added

    https://www.mycitycentrealbarsha.com/

  19. Scope added

    https://citycentredeira.com/

  20. Scope added

    https://ecoupon.maf.ae/

  21. Scope added

    https://partnerconnect.maf.ae/

  22. Scope added

    https://identity.majidalfuttaim.com

  23. Scope added

    https://www.premogiftcards.com

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

Majid Al Futtaim Properties invites you to test and help secure our primary publicly facing assets - focusing on our web and mobile applications. We appreciate your efforts and hard work in making the internet more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Valid P4 reports will be upgraded to P3 and paid at the following range: $150 - $200

Targets

Scope Testing is only authorized on the targets listed as In-Scope. Any domain/property of Majid Al Futtaim Properties not listed in the targets section is out of scope. Websites: Mall of the Emirates Website — https://www.malloftheemirates.com — Website Testing Mall of the Emirates (iOS) — https://apps.apple.com/app/mall-of-the-emirates-moe/id1449578693 — Mobile Application Testing — iOS Mall of the Emirates (Android) — https://play.google.com/store/apps/details?id=com.belongi.moe — Android Mobile Application Testing MAF Shopping Malls API — https://api.mafshoppingmalls.com/ — API Testing City Centre Deira — https://citycentredeira.com/ — Website Testing City Centre Zahia - citycentrezahia.com - Website Testing City Centre Al Barsha — https://www.mycitycentrealbarsha.com/ — Website Testing Partner Connect — https://partnerconnect.maf.ae/ — Website Testing Tilal Al Ghaf Website - https://www.tilalalghaf.com/en — Website Testing Junction Website - https://atjunction.com/ — Website Testing Ghafwoods Website - https://www.ghafwoods.com/en — Website Testing MAF Properties Website - https://www.majidalfuttaimproperties.com/en — Website Testing Mall of Oman - mallofoman.net/en Ecoupon - https://ecoupon.maf.ae/ Sitefinity Portal - https://smbu.mafcms.com/Sitefinity/adminapp/renderer/dashboard Mobile Apps: Belong by MAF (iOS) — https://apps.apple.com/us/app/belong-by-maf/id6443736108 — Mobile Application Testing — iOS Belong by MAF (Android) — https://play.google.com/store/apps/details?id=com.maf.communities&hl=en-US — Mobile Application Testing — Android City Centres Mobile App Mall of the Egypt Mobile App Mall of the Emirates - Mobile app APIs: https://maf-properties-prod.apigee.net -- API testing https://api.mafshoppingmalls.com -- API testing https://smbu-api.maf.ae/ -- API testing Access Credentials Please feel free to provision your own account(s) using your @bugcrowdninja.com e-mail address. More information on the Bugcrowd Ninja e-mail address can be found here: https://researcherdocs.bugcrowd.com/docs/your-bugcrowdninja-email-address For any in-scope target that requires registration, self-provision your own account using your @bugcrowdninja.com email. Focus Areas We are particularly interested in submissions that demonstrate the following impacts: Ability to remotely gain access to other user's PCI details (credit cards, CVV, etc.) Ability to remotely gain access to other user's personal details (first name, last name, contact details, passwords, etc.) Exfiltration of personal data or credit card data Remote unauthorized access to MAF Properties database Abuse of vouchers and promo codes Remote code execution Defacement Out-of-Scope The following activities and submission types are strictly prohibited or ineligible under this engagement: Do not modify data residing in an account that does not belong to you. Do not access or download data beyond the minimum required to demonstrate a vulnerability. This should not exceed 1–2 records if at all necessary. Do not attempt to execute actions that disrupt the availability of our systems (e.g. any volumetric or denial of service attacks). Do not post, transmit, upload, link to, send, or store any malicious software. Do not test in a manner that would result in the sending of unsolicited or unauthorized junk mail, SMS, spam, or other forms of duplicative or unsolicited messages. Do not test in a manner that would degrade the performance or operation of any system. Do not test third-party applications, websites, or services that integrate with or link to our systems. Do not make any changes to the system configurations, files, or data. Do not introduce a backdoor in any system. Do not in any way attack/interact with our end users. Do not engage in the trade of stolen/breached user credentials or use leaked credential dumps in the testing (no credential stuffing is allowed). Do not report any DMARC related issue for any in-scope domain. Please give Majid Al Futtaim 15 business days to apply any official patches for public zero-day vulnerabilities. Any submissions made prior to that window being closed will not be accepted. Credential leak reports are appreciated, but they are not eligible for reward. Authentication issues on https://identity.majidalfuttaim.com/ must be reported to our https://bugcrowd.com/mpass-og. Closing Note We appreciate the time and expertise our researcher community brings to this program. High-quality, well-documented submissions with provable PoCs provided aligned with the scope above will be prioritized for triage and reward. Thank you for partnering with Majid Al Futtaim Properties in keeping our customers and platforms safe.