SoundCloud

Description

At SoundCloud, we take the safety of our users very seriously. If you believe you have discovered a possible security vulnerability on our app(s), API(s), platform, or in any other SoundCloud service, please help us to fix it as quickly as possible by submitting your findings in accordance with this policy. Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, you have the opportunity to appeal, and make a case for a higher priority. Please ensure to kindly include a video recording with your submission, showing the steps taken to find the vulnerability.

Targets

Testing is only authorized on the targets listed as in-scope and that are not explicitly listed out-of-scope. Any domain/property of Soundcloud not listed in the targets section is out of scope. If you believe you've identified a vulnerability on a system outside the scope, please reach out to [email protected] before submitting. Target information soundcloud.com Main website for SoundCloud users api-*.soundcloud.com Our various APIs for soundcloud.com, our mobile applications, partners and others. See blow for an overview of different API endpoints. The public API (api.soundcloud.com) documentation is available here: https://developers.soundcloud.com/docs/api/guide api.soundcloud.com api-auth.soundcloud.com api-curators.soundcloud.com api-deck.soundcloud.com api-fortune.soundcloud.com api-mobile-creators.soundcloud.com api-mobile.soundcloud.com api-mobi.soundcloud.com api-partners.soundcloud.com api-pss.soundcloud.com api-v2.soundcloud.com api-widget.soundcloud.com m.soundcloud.com / mobi.soundcloud.com Mobile-optimized version of soundcloud.com checkout.soundcloud.com Payment site for purchasing SoundCloud Go and frontend to third-party payment platform secure.soundcloud.com Cross-device sign-ins (e.g. signing in from Xbox) and password reset flow w.soundcloud.com SoundCloud’s embeddable player widget s-cloud.net s-cloud.net is running a number of private services. All services under this domain should be behind authentication and use TLS (some self-signed). We welcome any submissions for this scope that demonstrate a security impact, such as authentication bypass or disclosure of private information. store.soundcloud.com Shopify-hosted storefront for SoundCloud merchandise and other items. We welcome any submissions for this scope that demonstrate a security impact due to a configuration issue managed or created by SoundCloud. Shopify-specific issues will be marked out-of-scope and should be submitted to Shopify's bounty program. Rules of Engagement Before submitting a report please run a DNS query for your domain and check if the respective CNAME points to a service owned by SoundCloud. If not, this domain is out-of-scope as we can not guarantee safe harbor for other 3rd party services. SoundCloud domains pointing to AWS, GCP or the IP range 178.249.136.0/21 are always in-scope, if not clearly marked out-of-scope. User Accounts & Access No credentials will be provided for this program. Researchers are encouraged to self-signup for and test using various types of user accounts (user accounts, artist accounts, etc.). DO NOT perform testing against any account you do not expressly own. You're free to create multiple accounts, but again, do not test against anything you don't personally own. Please note that there is an authenticated partners portal, but account credentials will not be supplied for this program. Feel free to test the authentication functionality. Testing Artist Pages & Comments We don't want to affect production users or create illegitimate traffic for SoundCloud end-users. Testing input parameters (comments, messaging, etc.) should NOT be performed on real artist or user pages. However, you're free to create your own accounts to test these areas, or use the following designated artist page to test input functionality for vulnerabilities: https://soundcloud.com/hobnobclanandthereflux Testing Payment Processing This program does not provide testing funds or reimbursements. However, if desired, researchers are welcome to use their own money to test paid SoundCloud features. Focus Areas Execution of arbitrary server-side code or system commands (RCE) XSS vectors with potential for fast automatic replication / “wormability” Account take-over Access to non-streaming optimized-audio assets Access to exclusive content without paying Manipulation of Related Tracks feature Out-of-Scope Network-level Denial of Service attacks Rate limiting attacks Any situation that affects a user that is not expressly yours Any situation that affects the integrity of third-party production data Copyright infringement report form ( https://soundcloud.com/pages/copyright/report/form ) Best practice recommendation without a proof-of-concept Target domains that do no belong to SoundCloud—make sure to check that the target domain indeed belongs to Soundcloud (run dig ) if the domain has a CNAME entry pointing to another domain that is not mentioned in the target section, this domain will also be counted as out-of-scope Violations of our referral program Terms of Service Any vulnerability the demonstrated impact of which is limited to an account that you already have access to Out-of-Scope Mobile API Token / OAuth secret recoverable in application binaries Shared links leaked through the system clipboard Exploits requiring a rooted or jailbroken device Temporarily Out-of-Scope Unauthorized access to paid features via direct API access (e.g. Insights on artists.soundcloud.com) Content injection vulnerabilities within the rendered body of emails sent from our platform (including, but not limited to, HTML Injection, Stored/Reflected XSS, and CSS Injection) Permitted Research Whitehat security researchers are always welcome, and responsible research and disclosure is not a matter for our lawyers. However, we do not tolerate any of the following, which will always be reported to the relevant authorities: any attempt to modify or destroy data (exempt for data specifically created in one or more test accounts for the purpose of the security research) any attempt to interrupt or degrade the services we offer to our users any attempt to execute a Denial of Service attack any attempt to access a user's account or data (exempt for data specifically created in one or more test accounts for the purpose of the security research) any research that involves violation of any applicable law Safe harbor for researchers When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state or national laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through this program, or inquire via [email protected] before going any further.

In-scope targets (in scope)

The below mentioned targets are in-scope. We serve different webpages and API endpoints (api-*.soundcloud.com) on our subdomains. All these sub-domains are in scope, if not explicitly listed in the out of scope section.