QuintoAndar Managed Bug Bounty Engagement

Description

No technology is perfect and QuintoAndar believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority. Please note: Only Critical (P1), Severe (P2), Moderate (P3), submissions will be rewarded. P4 & P5 findings will be marked as Low and Informational (respectively), but no reward will be paid.

Targets

Important Notes Testing is only authorized on the targets listed as in scope. Any domain/property of QuintoAndar not listed in the targets section is out of scope. This includes any/all subdomains not listed above. In general, services hosted for Quinto Andar by third parties are out of scope. We do not condone or grant permission to test on third-party assets. Submissions containing leaked credentials will be addressed on a case-by-case basis to determine whether or not there is a security impact. All vulnerabilities that require social engineering to be successfully exploited will be treated as P4. Reports involving the same path with different methods or subpaths will be evaluated on a case-by-case basis. If the vulnerabilities share the same root cause or require a common fix, they may be considered duplicates and not separately eligible for rewards. Scenario │ Example That may be considered the same root cause │ GET /api/user/info and GET /api/user/settings That may not be considered from the same root cause │ GET /api/user/info and POST /api/user/info Access All of the targets are accessible via the public internet. Please use markdown: Identifier │ Header │ Example Username │ X-Bug-Bounty: Bugcrowd- │ X-Bug-Bounty: Bugcrowd-proresearcher Out of Scope Vulnerabilities - Issues considered out of scope include: Vulnerabilities that allow unauthorized access but are intrinsic to the intended functionality of our systems based on established business rules, and block permissions from our operation. Credential leakages from end users that did not result from a failure of QuintoAndar's resources. Social engineering (e.g., phishing, vishing, smishing) is prohibited. Cross-Site Request Forgery (CSRF) on unauthenticated forms. Attacks requiring MITM or physical access to a user's device. Previously known vulnerable libraries without a working Proof of Concept. Comma-Separated Values (CSV) injection without demonstrating a vulnerability. Missing best practices in SSL/TLS configuration. Any activity that could lead to the disruption of our service (DoS). Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS Rate limiting or brute force issues on non-authentication endpoints Missing best practices in Content Security Policy. Missing HttpOnly or Secure flags on cookies Missing email best practices (Invalid, incomplete, or missing SPF/DKIM/DMARC records, etc.) Vulnerabilities only affect users of outdated or unpatched browsers (Less than 2 stable versions behind the latest released stable version) Software version disclosure, Banner identification issues, and Descriptive error messages or headers (e.g., stack traces, application or server errors) will not be eligible for a reward. Tabnabbing Subdomain takeover on subdomains that aren't in scope Open redirect (unless an additional security impact can be demonstrated) Issues that require unlikely user interaction will not be eligible for a reward. Credentials: Please use your bugcrowdninja email address if setting up specific user accounts. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good-faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.

In Scope (in scope)

Information about the targets can be found in the resource section.