Tamedia

Description

TX Group is the leading private media group in Switzerland. Belonging to TX Group, Tamedia is the business unit responsible for the Paid Media. We produce daily newspapers, Sunday newspapers and magazines, reaching Switzerland's entire population. Digital represents a core component of our current strategy, with all our newspapers featuring robust digital platforms alongside their print versions. Security remains paramount in our operation, therefore we've established a Bug Bounty Program to ensure security is embedded from the ground up. Please note that testing should only be conducted on our current production environment - do not perform any testing against legacy systems. Good luck and happy hunting. Please carefully read the scope description. Currently, submissions are accepted for www.inscopedomain.ch and non-authenticated testing only! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Paid-Media Frontends not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Paid-Media Frontends, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation. Target Information: The target environment is production, running on AWS (Node.JS) and MongoDB Atlas. Please note, the targets are all running on the same service. They share a codebase. If a vulnerability is valid for one it will be valid for all and only a single unique issue will be accepted as valid. Any submission involving the same vulnerability will be considered duplicated. Credentials: Currently authenticated testing is out of scope. Please do not sign up for any accounts as anything submitted that was found via authenticated testing will be marked as out of scope. Out-of-Scope Legacy Paid-Media Frontend websites Subdomain Takeover DMARC, SPF, DKIM issues Authenticated testing & sign ups Other domains, subdomains or paths not listed in the targets section iOS and Android apps Rate-limiting or (D)DoS attack related submissions Aggressive automated scans as these will most likely lock you out (by AWS) Attacks requiring physical access to a user's device. All third party applications or libraries/dependencies not under control by Tamedia Vulnerabilities affecting users of outdated browsers or platforms. Cookies missing secure or HttpOnly. Clickjacking and issues only exploitable through clickjacking. Broken Link Hijacking falls outside the purview of our monitoring protocol. Given the vast number of journalists and articles within our organization, it is not feasible for us to ensure that all links within our website lead to non-compromised destinations. While we do accept reports for broken links located in the footer or other static sections of our website, it is important to note that addressing broken link hijacking is not within the scope of our current program. Missing or not perfectly secured HTTP security headers, specifically ( https://owasp.org/www-project-secure-headers/ ), e.g. Strict-Transport-Security. X-Frame-Options. X-XSS-Protection. X-Content-Type-Options. Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP. Content-Security-Policy-Report-Only. Cache-Control and Pragma Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.