Syfe

Disclosure Policy

• Please do not discuss any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Follow HackerOne's disclosure guidelines.

Program Rules

Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.

• Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only award the first report received (provided it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• Social engineering (e.g., phishing, vishing, smishing) is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
• Ask the program team before submitting vulnerabilities on unscoped subdomains.
• Only interact with accounts you own or with the explicit permission of the account holder.

Test Plan

Syfe maintains non-production environments for security research. These are referred to as the test environment throughout this policy and correspond to the nonprod.syfe.com assets listed in scope.

Test Credentials

• Credentials for the test environment are claimed from the Credentials section of this program page on HackerOne.
• Access to credentials is governed by HackerOne platform guidelines. Researchers who do not yet meet the platform's eligibility criteria may be unable to claim them.
• We cannot issue test credentials by email or through any channel outside the HackerOne platform.

Test Environments

• https://uat-bugbounty.nonprod.syfe.com/ — primary web test environment
• https://api-uat-bugbounty.nonprod.syfe.com/ — API domain for the test environment

Reward Eligibility for Test Environment Findings

The test environment is an authorised target for security testing. Findings discovered there are eligible for reward where production impact is confirmed, either by:

• Safe, authorised reproduction on production, in line with the Production Testing requirements in this policy; or
• Verification that the affected code, component, or configuration is shared with production.

Severity and reward are assessed on the confirmed production impact, not on the impact observed in the test environment.

Where a vulnerability cannot be safely reproduced on production, submit your test environment evidence together with your assessment of the expected production impact and the reasoning behind it. Syfe will verify production exposure internally and update the report with the outcome. Our determination of whether the affected code, component, or configuration is shared with production is final.

Issues arising exclusively from test environment data, credentials, features, or configuration are not eligible unless separate production impact is demonstrated. See Non-Qualifying Bugs for specific examples.

Production Testing

Production testing is permitted within the following rules of engagement:

• Sign up at https://www.syfe.com/create-account?utm_source=bug_bounty&medium=bug_bounty using a @wearehackerone.com email address only.
• Include the header X-HackerOne-Research: [H1 username] on all production requests, including API requests.
• Interact only with accounts you own or for which you have the account holder's explicit permission.

The following are not permitted on production under any circumstances:

• Modifying, corrupting, or destroying data belonging to any other user
• Accessing, or attempting to access, another user's account, session, or personal information
• Authentication or authorisation bypass attempts against live accounts
• Brute-force, credential-stuffing, or enumeration attacks
• Automated scanning or high-volume automated tooling
• Any action that degrades, interrupts, or denies service availability

Where a vulnerability class cannot be demonstrated on production without breaching the above — for example authentication bypass, injection, or destructive actions — do not attempt it on production. Reproduce it in the test environment and submit it under Reward Eligibility for Test Environment Findings.

API Testing

API endpoints are in scope, on both production (api.syfe.com, alfred.syfe.com, mark8.syfe.com) and the test environment (api-uat-bugbounty.nonprod.syfe.com).

The same authentication requirements and rules of engagement apply to API testing as to web testing, including @wearehackerone.com signup and the X-HackerOne-Research header on production requests.

Automated scanning, fuzzing, and high-volume request generation against production API endpoints are not permitted. Use the test environment for this testing.

Reward eligibility for API findings on the test environment follows the same production impact requirement set out above.

Non-Qualifying Bugs / Known Issues

Typically, the following types of bugs and activities are not eligible for a bounty:

Test Environment Specific

• Debug functionality on the test environment, including debug views and debug login into any account. This functionality is not deployed to production.
• Test accounts, seeded test data, and shared test credentials, and any information disclosed about them.
• Findings that depend on controls deliberately relaxed on the test environment, including rate limits and other protections reduced for testing purposes.
• Functionality that exists only on the test environment and is not deployed to production.
• Disclosure of non-production configuration. Information disclosed on the test environment that is shared with production — for example a live secret or production configuration remains eligible.

General

• Security vulnerabilities on sites hosted by third parties (e.g. help.syfe.com) unless they lead to a vulnerability on a Syfe main app
• Promo code URLs on web archive; promo code enumeration
• Denial of service (DoS) on Syfe infrastructure
• Rate-limiting or brute-force issues, unless production impact is confirmed and the issue can be abused for account takeover or financial damage
• Self XSS / File Upload XSS
• Edit own account details for non-KYC verified accounts
• Response manipulation that only affects the UI, with no actual access to any accounts or features
• CORS-related issues unless you can exfiltrate data
• Exposed API keys without a proof of concept
• Pasting an authorization token from another account to access their details
• Spamming
• Social Engineering
• Missing best practices in SSL/TLS configuration
• Missing email best practices (invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
• Bugs affecting outdated or unpatched browsers
• Previously known vulnerable libraries without a working Proof of Concept
• Open redirect — unless an additional security impact can be demonstrated
• DOM XSS via redirect-url (widespread issue for which fix is already in progress)
• Root detection / jailbreak detection / SSL pinning bypass
• Credential leakage reports are considered informational if two-factor authentication (2FA) is in place

Disqualifiers

• Any modification or destruction of user data
• Overwhelming our support team with messages
• Taking any steps that intentionally violate the privacy of our users
• Denial of service, either against company infrastructure or user accounts
• Social engineering of any kind against our users or employees
• Any type of brute-forcing or automated attack techniques on production

Session Layer: HTTP Headers

For production environments, researchers should add headers to requests such as:

X-HackerOne-Research: [H1 username]

If you sign up on production, use only a @wearehackerone.com email address at https://www.syfe.com/create-account?utm_source=bug_bounty&medium=bug_bounty to be eligible for bounty and avoid any blocks.

Thank you for helping keep Syfe and our users safe!