Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

MTN Group

By MTN Vulnerability disclosure program on HackerOne mtn.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
482
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 5 days
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Pays cash
Yes we may decide to offer you a reward based upon our assessment of the criticality of the vulnerability
Response
Within 5 days We will respond to your report within 5 business days of receipt, with our evaluation of the report and an expected resolution date
Safe harbor
Full If you have followed the above instructions, we will not take any legal action against you regarding the report
Hall of fame
Yes If you agree, we‘ll publicly attribute the finding to your name in our Hall of Fame

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

482 assets you may test, 148 excluded.

Web 434

  • ac1-mymtn-app01.mtngh.root.net Critical No bounty
  • ac1-mymtn-app02.mtngh.root.net Critical No bounty
  • ac1-mymtn-app03.mtngh.root.net Critical No bounty
  • ac1-mymtn-db-01.mtngh.root.net Critical No bounty
  • ac1-mymtn-db-02.mtngh.root.net Critical No bounty
  • ac1-mymtn-rpt01.mtngh.root.net Critical No bounty
  • ac1-mymtn-rptdb.mtngh.root.net Critical No bounty
  • ac1-mymtn-stg.mtngh.root.net Critical No bounty
  • ac2-mymtn-app01.mtngh.root.net Critical No bounty
  • ac2-mymtn-app02.mtngh.root.net Critical No bounty
  • ac2-mymtn-app03.mtngh.root.net Critical No bounty
  • ac2-mymtn-app04.mtngh.root.net Critical No bounty
  • ac2-mymtn-app05.mtngh.root.net Critical No bounty
  • ac2-mymtn-db-01.mtngh.root.net Critical No bounty
  • ac2-mymtn-db01.mtngh.root.net Critical No bounty
  • ac2-mymtn-db-02.mtngh.root.net Critical No bounty
  • ac2-mymtn-db02.mtngh.root.net Critical No bounty
  • ac2-mymtn-rpt01.mtngh.root.net Critical No bounty
  • aimco.co.ke Critical No bounty
  • api.ayoba.me Critical No bounty
  • ascp.mtn.com Critical No bounty
  • autodiscover.outlook.com Medium No bounty
  • avatar.ayoba.me Critical No bounty
  • ayo.ba Critical No bounty
  • ayoba-donations.vercel.app Critical No bounty
  • ayoba.me Critical No bounty
  • bi-ebs.mtn.com Critical No bounty
  • cdn.cms.ayoba.me Critical No bounty
  • central.bayobab.africa Critical No bounty
  • chenosis-nonprod-dev.apigee.net Medium No bounty
  • chenosis-nonprod-test.apigee.net Medium No bounty
  • chenosis-prod-prod.apigee.net Medium No bounty
  • chenosis-prod-sandbox.apigee.net Medium No bounty
  • chenosis-prod-staging.apigee.net Medium No bounty
  • chenosisza-dev-cd-wpqlaq34dnebm9uo.edge.tenants.mtn-dev.auth0.com Medium No bounty
  • chenosisza-prod-cd-6qbqld53nwicqaof.edge.tenants.mtn.auth0.com Medium No bounty
  • cms.ayoba.me Critical No bounty
  • cms.dev.ayoba.me Critical No bounty
  • cms.stg.ayoba.me Critical No bounty
  • com.mtnghanar3 Medium No bounty
  • devapi.ayoba.me Critical No bounty
  • devcms.ayoba.me Critical No bounty
  • developer.ayoba.me Critical No bounty
  • _domainconnect.gd.domaincontrol.com Medium No bounty
  • dynamic-cdn.cms.ayoba.me Critical No bounty
  • ebs.mtn.com Critical No bounty
  • ecap.mtn.com Critical No bounty
  • epm.mtn.com Critical No bounty
  • eppm.mtn.com Critical No bounty
  • feed.ayoba.me Critical No bounty
  • flamyarvb01.mtn.co.za Critical No bounty
  • flamyarvb02.mtn.co.za Critical No bounty
  • flamyarvd01.mtn.co.za Critical No bounty
  • flamyarvs01.mtn.co.za Critical No bounty
  • flamyarvs02.mtn.co.za Critical No bounty
  • flamyarvs09.mtn.co.za Critical No bounty
  • flamyarvs10.mtn.co.za Critical No bounty
  • flamyarvt01.mtn.co.za Critical No bounty
  • fldmyarvb01.mtn.co.za Critical No bounty
  • fldmyarvb02.mtn.co.za Critical No bounty
  • fs-prdfus.mtn.com Critical No bounty
  • games.ayoba.me Critical No bounty
  • gh-pr-db01.mtngh.root.net Critical No bounty
  • gh-pr-db02.mtngh.root.net Critical No bounty
  • gh-pr-rpt01.mtn.com.gh Critical No bounty
  • ghs.googlehosted.com Medium No bounty
  • grc-aacg.mtn.com Critical No bounty
  • grc-ccg.mtn.com Critical No bounty
  • hotmtnpromo.com Critical No bounty
  • http://197.210.12.234 Medium No bounty
  • http://admin.marketplace.ayoba.me Medium No bounty
  • http://gamerplus.mtn.co.za Critical No bounty
  • http://internal.mtnzambia.co.zm High No bounty
  • http://mobilemoney.mtn.com.gh Medium No bounty
  • http://mtn.co.sz Medium No bounty
  • http://mtn.go-vip.net Medium No bounty
  • http://nlaolsrvq02.mtn.co.za:8006/rest/atg/v1/device/mtnsite Critical No bounty
  • https://1app.mtn.co.za Critical No bounty
  • https://5254877.app.netsuite.com/app/login/secure/enterpriselogin.nl?c=5254877&redirect=%2fapp%2fcenter%2fcard.nl%3fsc%3d-29%26whence%3d&whence= Medium No bounty
  • https://agentvetting.mtn.cm Medium No bounty
  • https://api.chenosis.io Medium No bounty
  • https://api.mtn.com Medium No bounty
  • https://apiportal.chenosis.io Medium No bounty
  • https://appbiz.momo.africa/content/v1_1 Medium No bounty
  • https://appbiz.momo.africa/content/v2_0_0 Medium No bounty
  • https://appx.developers.mtn.com Medium No bounty
  • https://auth.chenosis.io Medium No bounty
  • https://businessonboardinguat.momo.africa Critical No bounty
  • https://chenosis.io Medium No bounty
  • https://cms.momo.africa/v1_1 Medium No bounty
  • https://cms.momo.africa/v2_0_0/user/login Medium No bounty
  • https://cms.momo.africa/v2_1_0/user/login Medium No bounty
  • https://cms.momo.africa/v2_2_0/user/login Medium No bounty
  • https://cms.momo.africa/v2_3_0/user/login Medium No bounty
  • https://cms-ne.momo.africa/v2_0_0/user/login Medium No bounty
  • https://cms-ne.momo.africa/v2_1_0/user/login Medium No bounty
  • https://cms-ne.momo.africa/v2_2_0/user/login Medium No bounty
  • https://cms-ne.momo.africa/v2_3_0/user/login Medium No bounty
  • https://dep.mtn.co.za Critical No bounty
  • https://dev-appx.developers.mtn.com Medium No bounty
  • https://digitalpartners.mtn.co.za Critical No bounty
  • https://econnect-preprod.mtn.co.za/business/employee-connect Critical No bounty
  • https://kibana.infra.prod.westeurope.api.mtn.com/login Critical No bounty
  • https://lookerstudio.google.com Medium No bounty
  • https://momoapimdev.momo.africa/content Medium No bounty
  • https://momobusiness.mtn.cg/home Medium No bounty
  • https://momocmsdev.momo.africa Medium No bounty
  • https://momocmstst3.momo.africa Medium No bounty
  • https://momocmsuat.momo.africa Medium No bounty
  • https://mtn1app.mtncameroon.net:9443 Medium No bounty
  • https://mtnapp.mtn.co.za Critical No bounty
  • https://mtngroup.atlassian.net/wiki/home?feed=0 Medium No bounty
  • https://mtnid-preprod.mtn.co.za:443 Critical No bounty
  • https://mtnmomoagent.mtn.co.za Critical No bounty
  • https://mtn.service-now.com Medium No bounty
  • https://mtnsudan.samanage.com Critical No bounty
  • https://mycontract.mtn.co.za/landing/landing Critical No bounty
  • https://nextgenapine.momo.africa/content/v2_0_0 Medium No bounty
  • https://nextgenapine.momo.africa/content/v2_1_0 Medium No bounty
  • https://nextgenapine.momo.africa/content/v2_3_0 Critical No bounty
  • https://partner.mobilemoney.mtn.com.gh/partner Medium No bounty
  • https://portals-preprod.mtn.co.za:443 Critical No bounty
  • https://portalsso.mtn.co.za Critical No bounty
  • https://prebiz.momo.africa/content Medium No bounty
  • https://preprod.api.mtn.com Medium No bounty
  • https://preprod-appx.developers.mtn.com Medium No bounty
  • https://proxy.momoapi.mtn.com Medium No bounty
  • https://ringtune.mtn.co.za Critical No bounty
  • https://sandbox.momodeveloper.mtn.com Medium No bounty
  • https://shop.ayoba.me Medium No bounty
  • https://web.ayoba.me Medium No bounty
  • https://www.ayoba.me Medium No bounty
  • https://www.mtn.com/supply-chain Critical No bounty
  • https://www.mtn.co.za/business/ebu-prepaid/agent Critical No bounty
  • https://www.mtn.co.za/business/self-service/login Critical No bounty
  • https://www.mtn.co.za/business/shop/login Critical No bounty
  • https://www.mtn.co.za/gobozza Critical No bounty
  • https://www.mtn.co.za/home Critical No bounty
  • https://www.mtn.co.za/home/blackfriday/perl/io Critical No bounty
  • https://www.mtn.co.za/home/help/content/bill-and-payments Critical No bounty
  • https://www.mtn.co.za/home/help/content/mtn-chat Critical No bounty
  • https://www.mtn.co.za/home/pulse Critical No bounty
  • https://www.mtn.co.za/insurance Critical No bounty
  • https://www.mtn.co.za/insurance/claims Critical No bounty
  • https://www.mtn.co.za/insurance/device-cover Critical No bounty
  • https://www.mtn.co.za/insurance/portal Critical No bounty
  • https://www.mtn.co.za/pages/esim.aspx Critical No bounty
  • https://www.mtn.co.za/recharge Critical No bounty
  • https://www.mtn.co.za/shop/addlines Critical No bounty
  • https://www.mtn.co.za/shop/deals/devices Critical No bounty
  • https://www.mtn.co.za/shop/deals/devices/prepaid Critical No bounty
  • https://www.mtn.co.za/shop/new Critical No bounty
  • https://www.mtn.co.za/shop/upgrades Critical No bounty
  • https://www.pipedrive.com Medium No bounty
  • int.mtnbusiness.net Critical No bounty
  • invite.ayoba.me Critical No bounty
  • isupplier.mtn.com Critical No bounty
  • lonestarcell.com Critical No bounty
  • media-cms.ayoba.me Critical No bounty
  • microapps.ayoba.me Critical No bounty
  • mobilemoney.com.gh Medium No bounty
  • mobilemoneynigeria.net Medium No bounty
  • momobusiness.ng Medium No bounty
  • momo.com.gh Medium No bounty
  • momofrommtn.co.zm Critical No bounty
  • momomarket.com.gh Medium No bounty
  • momomerchant.ng Medium No bounty
  • momo.mtn.com Medium No bounty
  • momo.ng Medium No bounty
  • momo-payment-service-bank.ng Medium No bounty
  • momopsb1.ng Medium No bounty
  • momopsb3755.ng Medium No bounty
  • momo_psb.ng Medium No bounty
  • momopsb.ng Medium No bounty
  • ms-df.com Critical No bounty
  • mtn131.com Critical No bounty
  • mtn50.com Critical No bounty
  • mtnadvertising.com Critical No bounty
  • mtnairborn.com Critical No bounty
  • mtnanytimetopup.com Critical No bounty
  • mtnapps.net Critical No bounty
  • mtnappstore.com Critical No bounty
  • mtnatwork.com Critical No bounty
  • mtnayoba.com Critical No bounty
  • mtnbanking.com Critical No bounty
  • mtnbanking.net Critical No bounty
  • mtnbirthdays.com Critical No bounty
  • mtn.bj Critical No bounty
  • mtnbonus.com Critical No bounty
  • mtn.business Critical No bounty
  • mtnbusiness.com Critical No bounty
  • mtnbusiness.com.gh Medium No bounty
  • mtnbusiness.com.ng Critical No bounty
  • mtnbusiness.mobi Critical No bounty
  • mtnbusiness.net Critical No bounty
  • mtnbusinessolutions.com.gh Medium No bounty
  • mtnbussiness.com Critical No bounty
  • mtncallertunes.com Critical No bounty
  • mtncalls.com Critical No bounty
  • mtncameroon.net Critical No bounty
  • And 234 more on HackerOne.

Networks 44

  • 102.37.59.117 Medium No bounty
  • 102.88.18.116 Medium No bounty
  • 102.88.18.139 Medium No bounty
  • 102.88.18.208 Medium No bounty
  • 102.88.18.222 Medium No bounty
  • 104.155.11.146 Medium No bounty
  • 10.51.175.34 Medium No bounty
  • 134.122.111.176 Medium No bounty
  • 192.0.66.55 Medium No bounty
  • 196.201.32.0/24 Medium No bounty
  • 196.201.33.0/24 Medium No bounty
  • 196.201.33.219 Medium No bounty
  • 196.201.56.0/24 Medium No bounty
  • 196.201.57.0/24 Medium No bounty
  • 196.201.57.173 Medium No bounty
  • 196.201.57.174 Medium No bounty
  • 196.201.59.0/24 Medium No bounty
  • 197.210.12.150 Medium No bounty
  • 197.210.12.209 Medium No bounty
  • 197.210.12.215 Medium No bounty
  • 197.210.12.228 Medium No bounty
  • 197.210.12.229 Medium No bounty
  • 197.210.2.100 Medium No bounty
  • 197.210.248.13 Medium No bounty
  • 197.210.3.24 Medium No bounty
  • 197.210.3.30 Medium No bounty
  • 197.210.3.49 Medium No bounty
  • 197.210.3.60 Medium No bounty
  • 34.95.93.220 Medium No bounty
  • 41.181.247.123 Medium No bounty
  • 41.208.50.211 Critical No bounty
  • 41.216.70.2 Medium No bounty
  • 41.216.70.4 Medium No bounty
  • 41.216.70.5 Medium No bounty
  • 41.220.77.126 Medium No bounty
  • 41.220.77.13 Medium No bounty
  • 41.220.77.79 Medium No bounty
  • 41.222.32.131 Medium No bounty
  • 41.223.116.118 Medium No bounty
  • 41.223.117.5 Medium No bounty
  • 41.57.87.244 Medium No bounty
  • 41.79.218.66 Medium No bounty
  • 4.221.105.0 Medium No bounty
  • 4.221.118.253 Medium No bounty

Wildcard domains 1

  • *.momoafrica.tech Critical No bounty

Products and areas 3

  • http://flaeblrvd09:15002/ebilling-qa-ui/-1 Critical No bounty
  • http://jhmcgwrva01:8080 Critical No bounty
  • http://nlaussrvu01:9982/ Critical No bounty
Out of scope (148)
  • 41.216.80.172
  • h2cf3.n1.ips.mtn.co.ug:8070
  • http://129.0.197.215/
  • https://www.mtn.com/contact/become-supplier/
  • https://www.mtn.com/investors/sign-up-for-investor-information/
  • https://www.mtn.com/wp-json/wp/v2/users/
  • 41.189.179.249
  • 41.216.67.108
  • 41.216.78.13
  • achom.ir
  • areeba.com.gh
  • areeba.com.gn
  • electricityservices.mtn.com.sy
  • equity-group.org
  • faulucareers.co.ke
  • gameplus.mtnonline.com
  • games.mtnonline.com
  • h14de.n2.ips.mtn.co.ug
  • h1576.n2.ips.mtn.co.ug
  • h163e.n2.ips.mtn.co.ug
  • h18e.n1.ips.mtn.co.ug
  • h19f2.n2.ips.mtn.co.ug
  • h19f6.n2.ips.mtn.co.ug
  • h1b24.n2.ips.mtn.co.ug
  • h1b6e.n2.ips.mtn.co.ug
  • h1c1c.n2.ips.mtn.co.ug
  • h1c5b.n1.ips.mtn.co.ug
  • h1f7.n1.ips.mtn.co.ug
  • h1fa.n1.ips.mtn.co.ug
  • h2252.n1.ips.mtn.co.ug
  • h2276.n1.ips.mtn.co.ug
  • h22d.n1.ips.mtn.co.ug
  • h22eb.n1.ips.mtn.co.ug
  • h2302.n1.ips.mtn.co.ug
  • h234e.n1.ips.mtn.co.ug
  • h235.n1.ips.mtn.co.ug
  • h245a.n1.ips.mtn.co.ug
  • h2472.n1.ips.mtn.co.ug
  • h254e.n1.ips.mtn.co.ug
  • h27d6.n1.ips.mtn.co.ug
  • h27da.n1.ips.mtn.co.ug
  • h27d.n2.ips.mtn.co.ug
  • h2826.n1.ips.mtn.co.ug
  • h2a36.n1.ips.mtn.co.ug
  • h2a8.n1.ips.mtn.co.ug
  • h2cf3.n1.ips.mtn.co.ug
  • h2d5.n1.ips.mtn.co.ug
  • h2dea.n1.ips.mtn.co.ug
  • h2d.n1.ips.mtn.co.ug
  • h30e.n1.ips.mtn.co.ug
  • h341b.n1.ips.mtn.co.ug
  • h3426.n1.ips.mtn.co.ug
  • h37d.n1.ips.mtn.co.ug
  • h3b5.n1.ips.mtn.co.ug
  • h3b68.n1.ips.mtn.co.ug
  • h3b7.n1.ips.mtn.co.ug
  • h3e5.n1.ips.mtn.co.ug
  • h456.n1.ips.mtn.co.ug
  • h62a.n1.ips.mtn.co.ug
  • h652.n2.ips.mtn.co.ug
  • h696.n2.ips.mtn.co.ug
  • h69a.n2.ips.mtn.co.ug
  • h6a2.n2.ips.mtn.co.ug
  • h6a6.n2.ips.mtn.co.ug
  • h6b6.n2.ips.mtn.co.ug
  • h6ba.n2.ips.mtn.co.ug
  • h6c6.n2.ips.mtn.co.ug
  • h6ca.n2.ips.mtn.co.ug
  • h6ce.n1.ips.mtn.co.ug
  • h6d2.n2.ips.mtn.co.ug
  • h6d6.n2.ips.mtn.co.ug
  • h6fa.n1.ips.mtn.co.ug
  • h742.n1.ips.mtn.co.ug
  • h7c2.n1.ips.mtn.co.ug
  • h80e.n1.ips.mtn.co.ug
  • h82e.n1.ips.mtn.co.ug
  • h862.n1.ips.mtn.co.ug
  • h93e.n1.ips.mtn.co.ug
  • hb16.n1.ips.mtn.co.ug
  • hb56.n1.ips.mtn.co.ug
  • hb92.n1.ips.mtn.co.ug
  • hbce.n1.ips.mtn.co.ug
  • hd65.n2.ips.mtn.co.ug
  • he2.n1.ips.mtn.co.ug
  • hfa.n4.ips.mtn.co.ug
  • hfe.n1.ips.mtn.co.ug
  • http://154.160.67.169
  • http://197.210.96.58
  • https://www.evod.co.za
  • https://www.mtnbusiness.co.za/en/pages/msteams-direct-routing.aspx/43331
  • https://www.mtn.com/wp-json
  • https://www.mtn.com/wp-login.php
  • https://www.mtn.com/xmlrpc.php
  • irancel.ir
  • irancell.ir
  • jolie.ir
  • krysandchris.co.ke
  • lonestarcell.org
  • m-game.mtnonline.com
  • move2mtn.com
  • mtn-bissau.com
  • mtnblog.co.za
  • mtnbusiness.tel
  • mtn.com.cy
  • mtncompass.mobi
  • mtn.com.ye
  • mtn-eschool.com
  • mtnfootball.com
  • mtngame.net
  • mtngb.com
  • mtngbissau.com
  • mtnghbusiness.com
  • mtnghbusiness.mobi
  • mtnghbusiness.net
  • mtnghhostedservices.com
  • mtnghhostedservices.mobi
  • mtnghhostedservices.net
  • mtnghonlineservices.com
  • mtnghonlineservices.net
  • mtnhostedservices.com
  • mtnhostedservices.net
  • mtn-ic.com
  • mtnlibmusic.com
  • mtnmail.org
  • mtnmailsync.com
  • mtnmail.tel
  • mtnmmo.com
  • mtnmobad.mtnbusiness.com.ng
  • mtnmobilemoney.us
  • mtnmobility.net
  • mtnonlineservices.com
  • mtnpulse.tel
  • mtnrechargelink.com
  • mtnspotlight.com
  • mtnsyr.com
  • mtnvoicemail.com
  • mtn-weca.com
  • mtnzakhele.tel
  • mwstatic-game.mtnonline.com
  • novafone.com.lr
  • ptldynamic-game.mtnonline.com
  • ptlstatic-game.mtnonline.com
  • sharehub.co.ke
  • wap-game.mtnonline.com
  • wapstatic-game.mtnonline.com
  • www.mtnbusiness.co.za
  • yellomonitoring.ir
  • *.mtnfootball.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from MTN Group (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Execute or attempt to execute a Denial of Service (DoS)
  • Make changes to a system
  • Install malware of any kind
  • Social engineer our personnel or customers (including phishing)
  • Scan or run tests in a manner that would degrade the operation of the service or negatively affect our customers in any way
  • Physically attack or damage MTN property, offices or data centres or attempt to do so
  • Run tests on third party applications, websites or services that integrate with or link to MTN
  • Scan or attack any cloud hosted infrastructures such as Azure or Amazon Web Services or attempt to do so
  • Make use of any kind of automated scanning software.
  • Do not share discovered vulnerabilities with any entities or persons other than MTN and its employees until after MTN has confirmed the vulnerability has been resolved

Not accepted

  • Vulnerabilities affecting users of outdated or unsupported browsers or platforms
  • Issues that require unlikely user interaction
  • Clickjacking/UI Redressing
  • Reflected file download
  • Verbose error pages (without proof of exploitability)
  • SSL/TLS Best Practices
  • Incomplete/Missing SPF/DKIM
  • Fingerprinting / banner disclosure on common/public services
  • Disclosure of known public files or directories, (e.g. robots.txt)
  • Content spoofing (text injection)
  • Tabnabbing
  • OPTIONS HTTP method enabled
  • Recently disclosed 0-day vulnerabilities
  • Presence of autocomplete attribute on web forms
  • Use of a known-vulnerable library (without proof of exploitability)

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 18 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    https://appx.developers.mtn.com/

  2. Scope added

    https://dev-appx.developers.mtn.com/

  3. Scope added

    https://preprod-appx.developers.mtn.com/

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

At MTN, we are committed to keeping our systems, network and product(s) secure. Despite the measures we take, the presence of vulnerabilities will always be possible. When such vulnerabilities are found, we’d like to learn of them as soon as possible, allowing us to take swift action to improve our security.

MTN’s approach to Responsible Disclosure is as follows, you are allowed to search for vulnerabilities, as long as you don’t:

• Execute or attempt to execute a Denial of Service (DoS) • Make changes to a system • Install malware of any kind • Social engineer our personnel or customers (including phishing) • Scan or run tests in a manner that would degrade the operation of the service or negatively affect our customers in any way • Physically attack or damage MTN property, offices or data centres or attempt to do so • Run tests on third party applications, websites or services that integrate with or link to MTN • Scan or attack any cloud hosted infrastructures such as Azure or Amazon Web Services or attempt to do so • Make use of any kind of automated scanning software.

Breaching the above restrictions may result in MTN launching an investigation and/or taking legal action to the greatest extent of MTN’s legal obligation and rights or that of our partners and customers.

What we ask of you:

• Do not abuse or exploit discovered vulnerabilities in any way for any purpose • Do not share discovered vulnerabilities with any entities or persons other than MTN and its employees until after MTN has confirmed the vulnerability has been resolved • Provide us with adequate information to enable us to investigate the vulnerability properly. (To be able to investigate properly, we will need to be able to efficiently reproduce your steps.) • Provide us with information required to contact you (at least telephone number or email address).

What we promise:

• We will respond to your report within 5 business days of receipt, with our evaluation of the report and an expected resolution date • We will keep you regularly informed of our progress toward resolving the vulnerability • Any report submitted in relation to this Responsible Disclosure approach will be handled with great care with regards to the privacy of the reporter. We will not share your personal information with third parties without your permission, unless we are legally required to do so • If you have followed the above instructions, we will not take any legal action against you regarding the report

Rewards and attribution:

• MTN does not compensate individuals or organisations for identifying potential or confirmed vulnerabilities. • If you agree, we‘ll publicly attribute the finding to your name in our Hall of Fame

• Please do not ask for a reward before sharing the vulnerability, as we need to evaluate your report before responding • If you report a vulnerability that is unknown to us, and if you are not from a country where we are prohibited by law from making payments (e.g. due to sanctions), we may decide to offer you a reward based upon our assessment of the criticality of the vulnerability • If you agree, we‘ll publicly attribute the finding to your name in our Hall of Fame

Acquisitions:

For all our acquisitions, in order to give our development and security teams time for internal review and remediation, we will introduce a six-month blackout period. Bugs reported in that period will not qualify for a reward

Out of scope vulnerabilities:

• Vulnerabilities affecting users of outdated or unsupported browsers or platforms • Issues that require unlikely user interaction • Clickjacking/UI Redressing • Reflected file download • Verbose error pages (without proof of exploitability) • SSL/TLS Best Practices • Incomplete/Missing SPF/DKIM • Fingerprinting / banner disclosure on common/public services • Disclosure of known public files or directories, (e.g. robots.txt) • Content spoofing (text injection) • Tabnabbing • OPTIONS HTTP method enabled • Recently disclosed 0-day vulnerabilities • Presence of autocomplete attribute on web forms • Use of a known-vulnerable library (without proof of exploitability)