- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 36
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- No safe harbor
- No promise about legal action.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
We are not part of a cash/bug bounty program but are happy to issue a certificate of recognition to individuals who report security issues responsibly and help us make Nykaa systems more secure
- Hall of fame
-
Yes
“On behalf of Nykaa, we would like to thank the following people for making a responsible disclosure to us”
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
36 assets you may test, 4 excluded.
Android apps 10
- Disha mobile app ( Android )
- https://play.google.com/store/apps/details?gl=US&hl=en_IN&id=com.fsn.nykaa No bounty
- https://play.google.com/store/apps/details?id=com.fsn.nds No bounty
- https://play.google.com/store/apps/details?id=com.fsn.nykaa.disha No bounty
- https://play.google.com/store/apps/details?id=com.fsn.nykaa.man No bounty
- https://play.google.com/store/apps/details?id=com.fsn.nykaa.superstore No bounty
- Nykaa Beauty mobile app ( Android | iOS )
- NykaaFashion mobile app ( Android | iOS )
- NykaaMan mobile app ( Android | iOS )
- SuperStore mobile app ( Android )
Domains 10
- gajragang.com
- gloot.co.in
- iykykclub.com
- kicaactive.com
- nykaa.com
- nykaafashion.com
- nykaaman.com
- nykdbynykaa.com
- superstore.in
- twentydresses.com
Wildcard domains 10
- *.gajragang.com
- *.gloot.co.in
- *.iykykclub.com
- *.kicaactive.com
- *.nykaa.com
- *.nykaafashion.com
- *.nykaaman.com
- *.nykdbynykaa.com
- *.superstore.in
- *.twentydresses.com
iOS apps 6
- https://apps.apple.com/in/app/nykaa-fashion-shopping-app/id1439872423 No bounty
- https://apps.apple.com/in/app/nykaa-makeup-beauty-shopping/id1022363908 No bounty
- https://apps.apple.com/in/app/nykaa-man-mens-shopping-app/id1423089781 No bounty
- Nykaa Beauty mobile app ( Android | iOS )
- NykaaFashion mobile app ( Android | iOS )
- NykaaMan mobile app ( Android | iOS )
Out of scope (4)
- 3rd Party Applications
- All external services/software not managed or controlled by Nykaa
- Delivery Endpoints
- Vendor Endpoints
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Nykaa's policy. "We" in these lines means the program, not this site.
While testing
-
No user/customer data is modified, deleted or misused without prior explicit permission
-
The finding of vulnerabilities should not cause any disruption of services and thus a deprecated user experience for any user
-
You shall not expose the findings on any medium - including but not limited to social media, research papers and blogs (personal or otherwise)
-
Any and all information and/or finding(s) regarding the vulnerability shall be kept confidential between you and Nykaa and not disclosed to any third party by you at any time
-
Exploiting vulnerability for personal gains will lead us to take strict legal action against you
-
You shall allow us time to close the vulnerabilities identified
-
Assist in mitigation of the vulnerability if required
Not accepted
-
Vulnerabilities that do not demonstrate security impact will be considered out of scope for this program.
-
Vulnerabilities regarding SPF/DMARC/DKIM records without verifiable proof of spoofing
-
Best practice concerns like non-session cookies not marked secure and HTTP only, SSL/TLS configuration, missing security headers, etc.
-
Vulnerabilities reported by automated tools and scanners without additional proof of concept
-
End of Life Browsers / Old Browser versions (e.g. Internet Explorer 6)
-
Denial of Service(DoS) and Distributed Denial of Service(DDoS) attacks
-
Exploits that need physical access to the victim’s device
-
Host header injection
-
Unauthenticated/logout/login CSRF
-
Previously known vulnerable libraries without a working Proof of Concept
-
Any kind of spoofing attacks or any attacks that lead to phishing (e.g. Email spoofing, Capturing login credentials with fake login page)
-
Self XSS
-
Bugs requiring exceedingly unlikely user interaction example Social engineering attacks, both against users or Nykaa employees
-
OPTIONS / TRACE HTTP methods enabled
-
Known public files or directories disclosure (e.g. robots.txt, CSS/images, etc)
-
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality
-
Any kind of vulnerabilities that require installation of software like web browser add-ons, etc. in the victim's machine
-
Brute force on forms (e.g. Newsletter / ContactUs page)
-
Missing best practices in Content Security Policy.
-
Missing SSL, CAA headers
-
Functional, UI, and UX bugs and spelling mistakes.
-
Exploits that are reproducible only on rooted/jailbroken devices
-
Absence of certificate pinning
-
Bypassing root/jailbroken detection
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− iOS, − SuperStore mobile app, − NykaaMan mobile app and 4 more
-
Scope
− *.lbb.in, − *.pipabella.com, − https://play.google.com/store/apps/details?gl=US&hl=en_IN&id=littleblackbook.com... and 3 more
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.