The Coca-Cola Company Vulnerability Disclosure Program

Description

The Coca-Cola Company is proud of our researcher community and the impactful findings they have provided over the years. We are bringing our VDP program to Intigriti to further our community growth and provide some exciting changes around our VDP reward structure.

For more information about VDP rewards, please see the FAQ section below.

Rules of engagement

By participating in this program, you agree to:

• Respect the Community Code of Conduct
• Respect the Intigriti Terms and Conditions
• Respect the scope of the program
• Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

In scope

We have highlighted some assets above to help focus your testing efforts. However, with the exception of what is listed as explicitly out-of-scope you are welcome and encouraged to submit impactful findings on any asset you can attribute to The Coca-Cola Company or our brands!

We are proud to offer our community such an open scope and hope this will be welcoming for researchers and hacker no matter how new or veteran they might be!

Out of scope

Application

• API key disclosure without proven business impact
• Wordpress usernames disclosure
• Pre-Auth Account takeover/OAuth squatting
• Self-XSS that can't be used to exploit other users
• Verbose messages/files/directory listings without disclosing any sensitive information
• CORS misconfiguration on non-sensitive endpoints
• Missing cookie flags
• Missing security headers
• Cross-site Request Forgery with no or low impact
• Presence of autocomplete attribute on web forms
• Reverse tabnabbing
• Bypassing rate-limits or the non-existence of rate-limits.
• Best practices violations (password complexity, expiration, re-use, etc.)
• Clickjacking without proven impact/unrealistic user interaction
• CSV Injection
• Sessions not being invalidated (logout, enabling 2FA, etc.)
• Tokens leaked to third parties
• Anything related to email spoofing, SPF, DMARC or DKIM
• Content injection without being able to modify the HTML
• HTML Injection
• Unauthenticated Cache Purging
• Username/email enumeration
• Email bombing
• HTTP Request smuggling without any proven impact
• Homograph attacks
• XMLRPC enabled
• Banner grabbing/Version disclosure
• Not stripping metadata of files
• Same-site scripting
• Arbitrary file upload without proof of the existence of the uploaded file
• Blind SSRF without proven business impact (pingbacks aren't sufficient)
• Disclosed/misconfigured Google Maps API keys
• Host header injection without proven business impact
• Redirects
• Exposed PHP info pages without impact.
• Broken Link Hijacking

General

• In case that a reported vulnerability was already known to the company, it will be flagged as a duplicate
• Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
• Spam, social engineering and physical intrusion
• DoS/DDoS attacks or brute force attacks
• Vulnerabilities that only work on software that no longer receive security updates
• Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
• Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
• Reports that state that software is out of date/vulnerable without a proof-of-concept
• Reports of email addresses
• Internal Documentation without Impact
• Reports for assets related to TCCC partners will be relayed to the appropriate partner. Since TCCC has no control over partner assets, reports will be closed and future reports for the same issue will be marked as duplicate. Researchers will still receive a reward code.
• Reports related to CVE-2025-0133, as this is currently being handled internally.

Mobile

• Shared links leaked through the system clipboard
• Any URIs leaked because a malicious app has permission to view URIs opened
• The absence of certificate pinning
• Sensitive data in URLs/request bodies when protected by TLS
• Lack of obfuscation
• Path disclosure in the binary
• Lack of jailbreak & root detection
• Crashes due to malformed URL Schemes
• Lack of binary protection (anti-debugging) controls, mobile SSL pinning
• Snapshot/Pasteboard leakage
• Runtime hacking exploits (exploits only possible in a jailbroken environment)
• API key leakage used for insensitive activities/actions

Severity

This program follows Intigriti's triage standards based on Proof of Concept.

Accepted Issues and Severity When reporting vulnerabilities, please consider attack scenario/exploitability and the security impact of the bug. We may choose not to accept or to modify the severity of submissions in cases where there is no clear exploit chain, these include:

• "Best Practice" configuration items not part of a functioning exploit chain.
• Header Issues such as X-Frame-Options, CSP, etc.
• Cookie Configuration such as Missing "Secure" Flag on non-sensitive cookies or missing HTTPOnly properties.
• Mail security configurations such as invalid, incomplete, or missing SPF/DKIM/DMARC records.
• SSL/TLS configurations.
• Non-Sensitive information disclosures such as software versions, banner identifications, descriptive error messages, descriptive headers (stack traces, application or server errors).
• Attacks requiring MITM or physical access to a device.
• Use of vulnerable libraries without an associated working PoC.

However, it is important to note that in some cases a vulnerability's priority will be modified due to its likelihood or impact. In any instance where a vulnerability rating is modified, an explanation will be provided to the researcher - along with the opportunity to make a case for a higher priority.

Please be aware, The Coca-Cola Company uses Adobe Experience Manager for content management for the majority of its consumer facing websites. We accept vulnerability reports for AEM components and configurations, however, in cases where the same component is determined to be vulnerable across multiple AEM websites because of the shared codebase, these will be treated as one unique vulnerability with subsequent reports marked as duplicate.

FAQ

What's new with rewards?!

The Coca-Cola Company believes their researcher and hacker community should be rewarded for their contributions to security program. As a result, we will be offering Coke Store discount codes based on finding severity. Coca-Cola is not responsible for any import taxes or tariffs for orders. Returned orders using reward codes are not eligible for reimbursement or exchanges.

How are discount codes paid out?

On the first of each month TCCC will generate a discount code for each eligible report. Researchers will be sent codes via their reports once the codes have been generated.

Report was closed but I did not receive a code?

Reports will be closed when the vulnerability has been remediated. Your researcher/hacker handle will be noted internally and added to the closed report once the code has been generated.

What if I did not use all of my code for my purchase?

Right now codes are single use, so make it count. We are looking to fix this in the future but right now it's what we have.

Can codes be used for shipping?

All codes cover normal shipping costs.

Do codes have an expiration date?

Yes, 6 months from the time you receive the code.

Can codes be divided into more codes with smaller values?

No