Moovit Managed Bug Bounty Program

Description

Welcome to Moovit's Bug Bounty Program! We value the security and privacy of our users and are committed to maintaining a safe online environment. Please review our program guidelines and responsible disclosure policy for more details on how to report vulnerabilities, what's in scope, and the rules of engagement. Thank you for helping us maintain a secure environment for our users. As further elaborated below, we expect you to provide us with the full scope of information you come across when conducting your vulnerability research. Please try to minimize your access to personal information to the minimal extent possible. Moovit is an innovative app that revolutionizes the way people navigate and use public transportation, allowing commuters to plan their journeys seamlessly. With real-time data, accurate schedules, and detailed routes, Moovit provides reliable information on buses, trains, metros, trams, and other public transportation options available in over 3,200 cities worldwide. The key asset of Moovit is its user community, which actively contributes to the app's accuracy and richness of information. Users can report real-time updates, such as crowdedness, delays, or any disruptions in transit services, enabling fellow travelers to make informed decisions and avoid unnecessary delays. Moovit also offers features that cater to the needs of individuals with specific accessibility requirements. It provides information on wheelchair accessibility, step-free routes, and live updates to ensure an inclusive and convenient transit experience for all users. Additional functionalities include integration with ride-sharing services and the ability to save favorite locations and routes for quick access. Overall, Moovit revolutionizes public transportation by providing an efficient app that assists users in planning their journeys, accessing accurate real-time data, and contributing to the improvement of the transit experience. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Moovit not listed in the targets section is out of scope. This includes any/all subdomains not listed above. Target Information: Moovit’s iOS, Android, and Web app guides people in getting around town effectively and conveniently, using any mode of transport. Introduced in 2012 it now serves over 1.5 billion users in more than 3,500 cities across 112 countries. Moovit amasses up to six billion anonymous data points a day to add to the world’s largest repository of transit and urban mobility data. For governments, cities, transit agencies, and private companies Moovit offers AI-powered MaaS solutions covering planning, operations, and optimization with proven value in reducing congestion, growing ridership, and increasing efficiency and asset utilization. WayFinder (iPhone only) The way finder is a tool that helps users find their way to their stop or destination by using their camera Access: Apps are accessible to public in Google and Apple app stores Credentials: Accounts on the apps can be self-provisioned. Please sign up for an account using your program-dedicated @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Focus Areas: Authentication and Authorization Unrestricted access to API Privacy and data protection issues Bug Bounty Program Rules and Guidelines All issues must be reproducible All issues must demonstrate an actual impact Automated Testing such as scanners is not permitted All submission reports must follow the guidelines as shown below Do not create endless accounts on the system, in case this is a must, please approach the security team. Do not use attacks on physical security, social engineering, distributed denial of service (or any attack using large volumes of requests), spam or applications of third parties. Please avoid causing potential or actual damage. If you are uncertain, feel free to reach out to us before taking any action. Testing is allowed with your own personal account only. Do not engage with other accounts without the explicit permission of their owners. Do provide all information to enable us to reproduce the problem and any other relevant information with respect to the vulnerability. We address issues by identifying their root cause or component. Therefore, if the same issue arises in the same component but in different locations, it will be treated as a duplicate Out-of-Scope According to the general policy moovitapp.com or any web apps are OOS According to the general policy moovitapp.com every app not related to the Moovit mobile application is OOS The following bugs are unlikely to be eligible for a bounty: Clickjacking CSV Injection SSL / TLS issues Brute Force attacks Denial of Service attacks Issues found through automated testing "Scanner output" or scanner-generated reports Vulnerabilities requiring physical access to the victim's unlocked device Spam or Social Engineering techniques "Tab-Nabbing" or other rel="noopener" bugs without a severe impact Security bugs in third-party applications or services unless requested specifically Issues relating to Password Policy Full-Path Disclosure on any property Information Disclosure CSRF for non-authenticated sections Missing or misconfigured security headers Vulnerabilities that require Man in the Middle (MiTM) attacks Security bugs in Moovit.com - If you find a vulnerability in WordPress, please see WordPress bounty program for reporting details Missing security best practice without any tangible impact Confidentiality & Non-Disclosure Agreement (NDA) We take the privacy and security of our users and data seriously. As a condition of participation, researchers are required to sign an NDA to protect the confidentiality of information shared with you during the course of your research. Any reports and submissions shared with Moovit contain confidential information belonging to Moovit. This implies that you are obligated to maintain the confidentiality of your report or findings, refraining from disclosing them to any third party unless Moovit has granted written approval for such disclosure in advance. Disclaimer: This bug bounty program is subject to change at any time, and we reserve the right to modify or terminate the program as needed. Please refer to the program policy for additional details. Payment of any fees shall be subject to this policy, the program policy, and our sole discretion. Safe Harbor: We recognize the importance of responsible disclosure and will not initiate legal action against researchers who adhere to our responsible disclosure guidelines and this program rules. Your contributions to improving our security are greatly appreciated, and we are committed to working collaboratively to address any reported issues. When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

Limited Double Bounty Promotion | July 7th - July 22nd (in scope)

🚨 Double the Impact. Double the Rewards. 🚨 From July 7th to July 22nd , we’re turning up the heat with a Double Bounty Promotion across all in-scope assets! That’s right, during this limited-time window, every valid submission will earn twice the payout. This is your opportunity to dig deep, explore those edge cases, and uncover the vulnerabilities others might have missed. Everything in the In Scope target group is fair game, and every valid bug you land brings 2x the normal bounty straight to your account. (Meaning the bounty ranges on this group are the final payout amounts) The clock is ticking. The targets are waiting. Let the hunt begin and may the best bugs win big.

In Scope (in scope)

Target Moovit is a user-friendly public transportation app that helps you navigate cities with ease. It provides real-time information on buses, trains, and subways, offering route options, travel times, and updates on delays. The app's intuitive interface and customizable features make it a go-to tool for a smooth and efficient commuting experience, whether in a familiar city or exploring a new one.