Nubank Brasil Managed Bug Bounty Program

Description

We are one of the world’s largest digital banking platforms, serving more than 100 million customers across Brazil, Mexico, and Colombia. Nubank Brasil leverages proprietary technologies and innovative business practices to create new financial solutions and experiences for individuals and SMEs that are simple, intuitive, convenient, low-cost, empowering, and human. No technology is perfect, and Nubank Brasil believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our targets. You can feel free to start testing Nubank and reporting your bugs both using our apps, and our wildcards. Good luck, and happy hunting! Response Targets Nubank's Security Team will make the best effort to meet the following SLAs for hackers participating in our program: First Response: 2 days Time to Triage: 2 days Time to Resolution: depends on severity and complexity We’ll try to keep you informed about our progress throughout the process.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Nubank Brasil not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Nubank Brasil, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Access If you are a Brazilian researcher who owns a Taxpayer Registry number (CPF, in Brazil), you can also authenticate yourself so you can reach further results in your tests. In order to do that, you would just need to create an account in Nubank. You can start this process by downloading our apps on PlayStore and AppStore using your Android or iOS device. Please, also keep your personal information handy and attend a few prerequisites in order to successfully complete the process of creating an account with Nu, as a standard customer would: To be over 18 years old; To have a CPF register; To have a compatible device with the current version of our apps in Play Store and App Store; Given that, you just need to follow basic steps on the app's initial page and provide your personal information as the register flow requests it, including a picture of your ID. (RG, in Brazil) Your account will need to be approved by our teams, which normally takes less than one business day to happen. Reporting Account Blocks for Fraud Suspicion If your account is blocked due to suspected fraud during testing, please notify us as soon as possible and include details of the tests performed. We encourage you to submit a new report with the information to help us clarify the situation and address any concerns. Program Rules In order to ensure that your activity is not mistaken as malicious and blocked, we're asking that you use HTTP Headers. Example: "X-Correlation-Id: bc-handle" Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged. Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced). Multiple vulnerabilities caused by one underlying issue will be treated as one valid report. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder. Please note that only individuals with a valid Tax Identification Number (such as CPF in Brazil, CURP/RFC in Mexico, or NIT in Colombia) will be able to sign up for bank accounts with NuBank. Any use of false identification or fraudulent activities is explicitly out of scope. All areas of scope outside of those requiring a Brazilian TIN can be accessed by hackers outside of this region. Participation in this program by Nubank's employees and/or Third Party Providers is not permitted and any reports submitted will be considered invalid. PoC Monetary Limit To avoid potential issues with tests involving excessively high values, we have set a maximum limit of R$ 10 (or the minimum possible amount) for Proofs of Concept (PoCs).This ensures that tests remain within a manageable scope and helps prevent unforeseen complications. Quality Reporting When reporting an issue to this program, please be sure to include the following: a detailed replication steps (how to replicate this issue - in a step by step manner that could be followed by even non security-involved persons) a real-world exploit scenario (elaborate on WHAT an attacker could do with this vulnerability, and HOW they would go about doing so - please do not deal in extreme hypotheticals - e.g. those that would require the intervention of a nation-state, etc) -Please note that remediation steps must be actionable, and not generic advice such as “ensure that user input is sanitized”, etc. Submissions lacking detailed exploitation steps will not be eligible for reward Focus Areas While you’re free to test on any in scope targets on the brief, we’d like you to focus your special attention on the above targets and go deep to find critical issues. Nubank iOS: App Store Nubank Android: Play Store Wildcard *.nubank.com.br, *.nu.com.mx, *.nu.com.co NuInvest Out of Scope When reporting vulnerabilities, please consider (1) attack scenario/exploitability, and (2) security impact of the bug. The following issues are considered out of scope: Credential leakages from end users that were not resulted by a failure from Nubank's resources. Subdomain takeover reports require a working proof-of-concept demonstrating actual impact; dangling DNS records alone are not sufficient. Social engineering (e.g. phishing, vishing, smishing) is prohibited. Clickjacking on pages with no sensitive actions Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no proved impact Attacks requiring a privileged network position are out of scope unless a server-side misconfiguration directly enables the attack. Reports of vulnerable third-party libraries are only considered if accompanied by a PoC demonstrating exploitability in Nubank's environment. Comma Separated Values (CSV) injection without demonstrating a vulnerability. Missing best practices in SSL/TLS configuration. Any activity that could lead to the disruption of our service (DoS). Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS Rate limiting or bruteforce issues on non-authentication endpoints Missing best practices in SSL/TLS configuration. are out of scope unless accompanied by a concrete attack scenario beyond automated scanner output. Missing HttpOnly or Secure flags are only considered when affecting sensitive cookies (e.g. session tokens) with a demonstrated exploitation scenario. Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.) Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version] Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors). Tabnabbing Open redirect - unless an additional security impact can be demonstrated Issues that require unlikely user interaction; NuInvest's Hijacked Social Media Additional Disclosure Information Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without expressed consent from the organization. Follow Bugcrowd's standard disclosure terms . Safe Harbor

• When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.

Out of Scope (out of scope)

NuCommunity assets (BR, MX, CO) are temporarily out of scope due to scheduled internal maintenance. We will notify all researchers via broadcast as soon as they are available for testing again.