Plusgrade Loyalty Public Program

Description

No technology is perfect and Plusgrade believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We care about our partners' information security, and we're ready to work with security researchers to improve the security of our services. Plusgrade believes that ethical security research performed in good-faith provides an invaluable public service. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web applications. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority. Program Rules: IMPORTANT: Applications within the same target group of this engagement may share the same codebase. Vulnerability reports submitted on the same vulnerability across different endpoints belonging to the same Plusgrade scope grouping are not eligible for multiple rewards. Multiple reports on the same vulnerability will be considered duplicates. Please submit a single report.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Plusgrade not listed in the targets section, or the additional resources tab, is out of scope. Any submissions that are not on the in-scope targets will be marked as out of scope and will not be eligible for monetary or points-based compensation. Please be cautious with the use of vulnerability scanners on this program. Custom scripts and fuzzing tools are permitted, however if using an automated tool or script please throttle traffic to six requests per second or less. Credentials: Plusgrade does not provide credentials or authorization links for security research purposes. To perform authenticated testing, researchers are expected to already have, or to obtain, a legitimate & verified login created in their own name (not leaked or compromised) from the associated loyalty program, or be in possession of a valid upgrade authorization link. Please abide by the rules of the loyalty program in question, and bear in mind that loyalty programs may limit the use of multiple accounts for the same individual. Unauthenticated testing may be performed against in-scope targets without a loyalty account or upgrade authorization link. If you encounter leaked or compromised credentials for in scope targets, please do not use them, or attempt to use them. Focus Areas: We identified the following focus areas to facilitate your testing and would like you to report your efforts around these (Please note you’re free and encouraged to test outside of the following, these are just a few areas that are particularly important to us): Remote code execution (RCE) Injection attacks (SQL injection, Command injection, XML injection, CRLF injection) XML external entity (XXE) Cross site scripting (XSS) Server side request forgery (SSRF) Cross site request forgery (CSRF) Directory traversal - local file inclusion Authentication/authorization bypass Privilege escalation Insecure direct object reference (IDOR) Site and server misconfigurations Web cache deception Cross-Origin Resource Sharing misconfiguration (CORS) Open redirect Information disclosure Request smuggling Mixed content Out-of-Scope Areas Corporate email and file storage Corporate VPN 3rd party applications and services SPF, DKIM and DMARC submissions Expectations Make a good-faith effort to avoid harm to Plusgrade Inc, our subsidiaries, our customers, and our end-users, including, but not limited to: privacy violations, destruction of data, and interruption or degradation of our services. Do not access or attempt to access Plusgrade offices, data centers, or user accounts. Do not test for spam, perform phishing, social engineer, or intentionally cause denial of service issues for Plusgrade services. Do not access or attempt to access our partner's systems, data centers, user accounts, or attempt other forms of penetration testing without the direct, written approval of the system owner. Comply with all applicable laws and regulations; do not disrupt or compromise any data that is not your own, or further exploit a confirmed vulnerability. If a vulnerability provides unintended access to data, limit the amount of data you access to the minimum required to demonstrate a proof of concept. After Plusgrade validates your report, properly dispose of all copies of the data. Please do not cache any submission or finding publicly on sites such as the Internet Archive. When making submissions that involve deep links, magic links or personalized links, you must include the details on how the link was obtained. Failure to do so may result in the submission being ineligible for reward. Submissions that uniquely involve the finding of deep links, magic links or personalized links in search engines, archives or other repositories are only eligible for informational (P5) submission. To qualify for other rating levels, the researcher must demonstrate how the link ended up in the search engine, archive or repository. Only active links will be considered. Expired links do not qualify. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further. Disclosure This program or engagement does not allow disclosure. You may not release information about vulnerabilities found in this program or engagement to the public.

Loyalty (in scope)

This target group focuses on loyalty programs for the global travel & hospitality industry.

Out-Of-Scope (out of scope)

We realize that it can be confusing where Plusgrade's services end and our partner's service begin (and vice-versa). We often display branded pages on behalf of our partners. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.