Skyscanner

Description

Welcome to Skyscanner's Bug Bounty program Keeping traveller's information safe and secure is a top priority for Skyscanner. We welcome the contribution of security researchers and look forward to rewarding them for their invaluable contribution to the security of all Skyscanner travellers. We invite researchers to test the Skyscanner website and mobile apps in line with the principles set out in this brief. Guidelines We request thorough proof-of-concept/replication of the bug, including videos, images, and a description of the business impact. These will all factor into our bounty decision-making process. To promote the discovery and reporting of vulnerabilities we ask that you: share the security issue with us in detail act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services (including Denial of Service) comply with all applicable laws understand that all valid reports will be taken seriously by our engineering teams Expectations We expect researchers to follow the program rules: Researchers must : add the following header to all HTTP requests: Skyscanner-Security: Bugcrowd use your [email protected] email address for accounts not access or modify our, or travellers' data, without explicit prior permission of the owner. Only interact with your own accounts or provided test accounts for security research purposes contact us immediately if you inadvertently encounter traveller data. Do not view, alter, save, store, transfer, or otherwise access the data, and immediately purge any local information upon reporting the vulnerability to Skyscanner perform testing and research only within the areas that are in scope follow the Bugcrowd Coordinated Disclosure rules In addition, we count the following activities as strictly prohibited , and thus not rewardable. These are in addition to the Bugcrowd Vulnerability Rating Taxonomy : Social Engineering attacks DDoS Excessive use of automated vulnerability / scanning tools Please do not spam forms or account creation flows using automated scanners We have a number of rate limits in place that may result in your IP address being blocked if you use such tools Any testing of corporate email ( @skyscanner.net ) We will offer monetary rewards for the first submitted report of a vulnerability . Public disclosure of the vulnerability prior to resolution may cancel a pending reward. We reserve the right to disqualify individuals from the program for disrespectful or disruptive behaviour. We will not negotiate in response to duress or threats (e.g. we will not negotiate the payout amount under threat of withholding the vulnerability, or of releasing the vulnerability or any exposed data to the public). We reserve the right to deduct a 10% penalty on valid and accepted submissions that do not follow the guidelines mentioned above. Following the guidelines will help us triage the vulnerability more effectively from our side, which should result in faster processing of the submission We are under no obligation to pay out for any bugs that are not submitted in accordance with this policy or any of the Bugcrowd policies. We reserve the right to withdraw this scheme at any time and shall have no obligation to pay out for any bugs submitted after closure of the scheme. Rating & Reward Information: For the initial prioritization/rating of findings, this program uses the Bugcrowd Vulnerability Rating Taxonomy . However, please note that in some cases, the priority rating will be altered due to reflect the likelihood or impact of an exploit. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. We will award greater bounties for all valid submissions contained in our Focus Areas (see Target Information). Priority │ Reward range P1 │ $3,000 – $8,000 P2 │ $900 – $3,000* P3 │ $300 – $500 P4 │ $100 – $150 *The highest rewards will be reserved for submissions deemed to have high business criticality. Other: Vulnerabilities found in multiple fields in the same form or using the same CSRF token will be counted as a single vulnerability. Subsequent submissions will be marked as Not Applicable . Please detail all affected fields in a single submission. Vulnerabilities that can be exploited with similar payloads on the same path are only eligible for a single reward. Subsequent submissions will be marked Not Applicable . Vulnerabilities exploitable with similar payloads on the same path/source will only be eligible for one reward, and additional reports will be marked Not Applicable . This approach ensures a focused and effective evaluation of distinct security risks. DNS Takeovers and Reward Adjustments: For DNS takeovers involving main domains, the original reward amount will be maintained to reflect the severity and impact of the issue. However, for DNS takeovers associated with domains used primarily for brand protection, acknowledging their lower criticality, the reward amount will be decided post evaluation. If multiple reports are submitted for vulnerabilities with the same root cause, the initial submission will receive the full reward value, while subsequent reports will be marked Not Applicable . Reporting leaked credentials: Submissions about leaked credentials belonging to either systems/services in the scope or Skyscanner employees, will be rewarded only with program points and not with a bounty reward. AI and Prompt-Injection Findings Prompt injection or system-prompt disclosure involving only non-sensitive instructions will generally be treated as low risk, even when publicly accessible without authentication. Higher severity requires broader demonstrated impact, such as secrets or PII disclosure, cross-user exposure, persistent manipulation, privileged actions, or material availability/cost impact. Safe Harbor compliance When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.

Targets

Target info: Below is a summary of all the targets we will consider submissions for. Please read this section thoroughly for more information on each target, as well as our main Focus Areas. Skyscanner website https://.skyscanner.net/ Vulnerabilities found in any other regional domain with the same codebase (such as skyscanner.fr/* ) will be considered the same vulnerability All subdomains are in the scope of this program unless explicitly excluded Skyscanner iOS and Android Apps Skyscanner iOS App can be downloaded from the Apple App Store Skyscanner Android App can be downloaded from the Google Play Store Application code in the APK and any data it creates and saves on the device Features or code provided by separate web services will be in the scope of the service itself , not the app Focus Areas skyscanner.net/profile/* Auth0 endpoints should be used only to: Test authentication and session management flows Manually verify potential vulnerabilities like XSS / Open Redirects Handling stored payment details (Card Tokens) Important: See the Out of Scope section (below) for issues not in scope Re-owning Anonymous Bookings by fully verified account using Mobile Applications. Implementation of the Anonymous Bookings Re-owning feature to allow travellers to re-own anonymous bookings which they did whilst unauthenticated. This flow relies on the bookings made using the same email address using the mobile application (Deeplink with BookingHistory and BookingDetails endpoints). This feature uses the "Secure-anon_token" cookie, account verification state and matching traveller details to one submitted during the booking partnerportal.skyscanner.net/* Please note that a user account will not be provided We are interested in testing for: Authentication issues Serious information disclosure Out of Scope The following issues are outside the scope of our rewards program: Third Party tools and services: Vulnerabilities found in third party products or services are not rewardable unless they are unique to our configuration or present a serious business risk (at our discretion). The following sub-domains are out of scope as they are hosted and managed by third parties: help.skyscanner.net, carhirehelp.skyscanner.net, hotelshelp.skyscanner.net, support.business.skyscanner.net, www.partners.skyscanner.net, creators.skyscanner.net, preferences.skyscanner.net Out-of-scope on skyscanner.net/profile/* : Password, email and account policies, such as email id verification, reset link expiration, password complexity, session expiry Any report that relates to learning whether a given username, email address has a Skyscanner account. Ability to share links without verifying email. Large scale account enumeration or brute force that might lead the lock-out of a real user's account Auth0 endpoints Other: Attacks requiring physical access to a user's device. Host header injections unless you can show how they can lead to stealing user data. Reports of spam (i.e., any report involving the ability to send emails without rate limits). Attacks that require the attacker app to have permission to overlay on top of our app (e.g., tapjacking). Vulnerabilities affecting users of outdated browsers or platforms. DMARC policies being set to none or SPF policies set to SoftFail . Social engineering of Skyscanner employees or contractors. Any physical attempts against Skyscanner property or data centers. Any access to data where the targeted user needs to be operating a rooted mobile device. Content spoofing vulnerabilities (where you can only inject text or an image into a page) are out of scope. We will accept and resolve a spoofing vulnerability where attacker can inject image or rich text (HTML), but it is not eligible for a bounty. Pure text injection is out of scope. Absence of rate limiting, unless related to authentication. IP/Port Scanning via Skyscanner services unless you are able to hit private IPs or Skyscanner servers. Devices (iOS, Android, desktop apps) not getting unlinked on password change. Phishing risk via unicode/punycode or RTLO issues. CSRF-based modification of currency, locale, and market parameters.

AI Bias Testing (in scope)

Overview Our mobile application offers a unique feature for travelers to receive recommendations and destinations based on their specific queries. This functionality is powered by an instance of OpenAI, which processes user requests and provides appropriate location suggestions. The recommendations are limited to locations where we operate and are only available to users in English-speaking markets. Functionality Description User Query Submission: Users can submit queries asking for travel recommendations. Example Query: "I would like to make a gastronomic travel." Response Generation: The OpenAI instance processes the query and responds with a list of valid destinations. Example Output: Paris Tokyo Rome Market Limitation: This feature is only accessible in English-speaking markets. Recommendations are restricted to locations where our services are available. Scope of Testing Verify that the functionality accurately processes user queries and returns only appropriate recommendations (no harmful, offensive, or deceptive content are allowed). The AI/Savvy search has been trained with publicly available past data, making new information not available in the model, so it may display inexact or outdated information sometimes. That is an acceptable behavior from LLM models. Verify that is not possible to perform attacks like prompt injection, data poisoning, etc. Only safety/security issues will be accepted. Ambiguous or unspecific responses from the AI are expected. Exclusions Internal information is not shared via this feature; therefore, the risk of data leakage is very low. Testing should focus on having appropriate and valid recommendations, rather than backend vulnerabilities. Any other feature of the mobile application is out of the scope. Reporting Guidelines Clearly describe the steps to reproduce any issues found, and the impact it would have. Provide screenshots or recordings where possible to illustrate the issue. Ensure that any reported issues are within the scope of the described functionality. Reward Criteria Valid issues related to unlawful recommendations or access limitations will be considered for rewards. Out-of-scope issues, such as backend vulnerabilities unrelated to the described functionality, will not be eligible for rewards. Example Query for Testing Query: "_I would like to explore historical sites. _" Expected Output: (Example) Athens Cairo Beijing By following these instructions, you can effectively test the travel recommendation functionality in our mobile application and contribute to improving its accuracy and reliability.

AWS Infrastructure (in scope)

Overview We accept AWS infrastructure related submissions for the configuration of services such as Route53, S3, or Cloudfront; as long as they are clearly related to Skyscanner's resources in the AWS cloud. Example of these issues are Route 53 dangling records, unprotected S3 buckets, or insecure Cloudfront distribution configuration. Scope You must comply with AWS Customer Service Policy for Security Testing . The issue should be related to a Skyscanner's specific configuration (We will not accept vulnerabilities in services with a default configuration or general AWS issues). You must provide a proof of concept for the issue (Theoretic issues such as "weak encryption" will not be accepted without a demonstration). The output of automated tools alone will not be accepted as proof of concept / impact. Reward Criteria The issues would be rewarded according to the impact on Skyscanner's services alone, and not on other third parties.