Square

Description

Block, Inc. In 2021, Square officially changed its name to Block with Square now being one of our product lines. The Square Bug Bounty program is limited to this line of business and includes the target components outlined in the ‘Target Information’ section. Block engages with Bugcrowd to provide proactive security testing across the majority of our other product lines. Please reach out to [email protected] if you have any questions. You can participate in our other product bug bounty programs as noted below: Cash App Tidal Afterpay Block Open Source Serious about security Our approach to security is designed to protect buyers and sellers. We monitor every transaction, continuously innovate in fraud prevention, and we protect businesses’ data like our business depends on it—because it does. We adhere to industry-leading standards to manage our network, secure our web and client applications, and set policies across our organization. Ratings and rewards Only Critical (P1), Severe (P2), and Moderate (P3) submissions will be rewarded. P4 findings will NOT be accepted. For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Access A Bugcrowd account is required. Please sign up for a Square account using your @bugcrowdninja.com email address only. Do not use personal email addresses. If for any reason your Square seller account gets deactivated during testing, please escalate to Bugcrowd. Do not create multiple merchant accounts as this can be disruptive. If your testing requires two separate Square accounts, please add "+1" to your email address for the secondary account. Using your @bugcrowdninja.com address helps us identify you. For more info regarding @bugcrowdninja email addresses, see here . Rules of Engagement If you are able to access or modify personal data of Square customers or other sensitive data, immediately contact Block - do not attempt to conduct post-exploitation work. Do not use, share, publish, or disclose information obtained in the course of identifying issues. After submitting you must delete, purge, and/or destroy all copies of information or digital samples. For test merchant accounts, please do not sign up for Text Message Marketing (TMM) or Messages Plus (M+) products as both are used for verification of business. This would have negative impact with our carriers. If you have any questions on our third party products, we encourage you to reach out. Do not attempt a denial-of-service attack. For hardware testing, research must be done on one's own Square Register or Terminal. Do not use ChatGPT, DeepSeek, Google Gemini or any AI tools during your research. You may not disclose any information within these platforms. Please contact [email protected] for any escalations. Do not contact Block or Block aliases to follow up on submissions. Doing so can result in point reduction or program expulsion. Focus Areas Flaws within payments or checkout flows, especially findings that may expose personal information Square Banking (see here ) Issues in our hardware or firmware of Square's point of sale (POS) systems

Targets

Any finding or (sub)domain that is not listed in scope but is confirmed owned by Block may be accepted upon review. We will not accept submissions outside of this line of business (Square) that is for another product line (Cash, Afterpay, Tidal). Subdomain Takeovers Payouts for Subdomain Takeover findings differ from the rewards listed above. Please review the severity and descriptions below before submitting a report. Impact │ Severity │ Reward │ Description High Impact Subdomain Takeover │ P2 │ $1,000 - $5,000 │ Rewarded for domains and subdomains with reputational or technical risk. Also for subdomains under a parent domain with reputational or technical risk, and access to sensitive data on that parent domain. Basic Subdomain Takeover │ P3 │ $250 - $500 │ Rewarded for domains and subdomains under a parent domain with reputational or technical risk, but without access to sensitive data on that parent domain. MX Takeover (Mailgun) │ N/A │ N/A │ Not rewardable unless the domain or subdomain is verified within Mailgun and one can send an actual message. If valid, please provide full header information. Hardware Testing Testing and research must be done on one's own Square Register or Terminal. If you find any security vulnerability related to our hardware assets, please submit a report. Known Issues Staff Permissions Vulnerabilities will not be accepted when they involve scenarios where: Employee A exceeds their authorized access level to perform actions within merchant accounts One employee attacks another employee's account or access privileges Internal team members gain unauthorized access to owner-level functions or data iFrame Injections found at Square Dashboard Current Status: The team is developing a systematic fix to block all unauthorized iframe injections across the platform. Info Stealer Logs Block is aware of credentials obtained from stealer log malware. While we encourage researchers to submit findings that impact Block or Block customers, we reserve the right to treat each submission and reward on a case by case basis. Payout may not align with our standard payout scheme. Submission Quality Detailed steps for reproducing the bug - please include any screenshots, links you clicked on, pages visited, etc., we prefer detailed reproduction steps and video demos. Describe the versions of all relevant components of the attack (eg browser, OS, mobile app version). Describe a concrete attack scenario. How will the problem impact Block or Square buyers/sellers? Put the problem into context and demonstrate with clear evidence. Consolidate similar issues into a single report, especially if they affect multiple locations (e.g., an authorization bypass on several endpoints). This streamlines our triage, speeds processing, and allows for holistic evaluation and reward. Third Party Vendor Policy Third party submissions will be considered Out of Scope. With that said, if you believe you’ve identified an issue with one of our third-party service providers as a result of Square’s misconfiguration or insecure usage of that service, we’d appreciate you reaching out. Please keep in mind that any report regarding third-party services are likely to NOT be eligible for a reward – both cash and kudos points. Program Exclusions Any target that is covered under another Block bug bounty program (e.g. Cash App, Tidal, Afterpay) including those covered under Private programs Any vulnerabilities found in third-party software Any physical attempts against Block property or data centers Hijacking or installing a third-party app to attack the Square platform Any research findings involving an attempt to view, modify, access, disclose, exfiltrate, use, or damage data belonging to Square, its customers, or others. Invoices found online via a web archive or malware assessment services (virustotal.com, alienvault.com. URLscan.io, etc.); invoice links are set to expire and were uploaded by users, this is not within our control Vulnerabilities involving prompt injection attacks (jailbreaking) or prompt disclosure (prompt leaking) Prompt injection that allows arbitrary prompts to be answered without demonstrated security impact Self-inflicted prompt injection vulnerabilities such as XSS without demonstrated security impact Reported vulnerabilities within Team Permissions (squareup.com/dashboard/team/permissions) involving XSS, Broken Access Control, IDOR, Sensitive Data Exposure, etc. (i.e. Employee A has exceeded their access to perform certain actions within a merchant account or attacked Employee B) will not be accepted. Logout CSRF Lack of rate limiting Content Spoofing > Impersonation via Broken Link Hijacking Presence of autocomplete attribute on web forms Missing cookie flags on non-sensitive cookies No maximum password length Exposure of public keys (these are designed to be public, please review the type of encryption key before reporting it) An oracle that discloses whether a given username, email address, or phone number is associated with an actual account (However, please do submit anything that allows you to recover usernames en masse) Using spoofed emails for phishing Reports of the 2-factor token not expiring, we use TOTP codes for 2-factor Any research, data access or testing that violates the law Cache poisoning resulting in DoS Square Seller Community P4 submissions will not be accepted (If any P4 submissions are submitted, they will not be triaged and will be marked as N/A) Disclosure Procedures Block recognizes the important contributions the security research community can make. We do not publicly disclose vulnerabilities by default. We take the security of our services very seriously and monitor their use for indications of a malicious attack. In order to distinguish legitimate security research from malicious attacks against our services, we promise not to bring legal action against researchers who: Share with us the full details of any problem found. Do not disclose the issue to others until we’ve had a reasonable time to address it and disclosure has been approved by us. Do not intentionally harm the experience or usefulness of the service to others. Never attempt to view, modify, access, disclose, exfiltrate, use or damage data belonging to Block, its customers, or others. Do not attempt a denial-of-service attack. Do not perform any research or testing in violation of the law.

██████ (in scope)

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████