Trendyol

As DSM GRUP DANIŞMANLIK İLETİŞİM VE TİCARET A.Ş. (“DSM”), we highly value security and privacy and look forward to working with the security community to find security vulnerabilities in order to keep our businesses and customers safe. Off the back of a successful HackerOne Challenge, we are excited to continue leveraging Hacker Powered Security with HackerOne's diverse talent pool.

Response Targets

DSM will make its best effort to meet the following SLAs for hackers participating in our program:

We will make every effort to keep you informed of our progress throughout the remediation process.

Scope

Our core target assets are listed in the table below.

Note: For all Web / API targets, API calls initiated from both web and mobile applications are explicitly accepted in scope.

Test Plan

Web traffic to and from DSM properties produces petabytes of data every day. To ensure your testing is identified correctly and our SOC team does not block your research activity, please follow these instructions:

• Accounts: Please create accounts using your [email protected] email address. Some of our properties will require this to be eligible for a bounty.
• Custom Header: You must include the following custom HTTP header in all your traffic: X-Bug-Bounty: hackerone-{username}

Program Rules

We expect researchers to adhere to the "Do No Harm" principle. In the event of a violation, you may face exclusion from the program:

• Focus on Impact: We evaluate reports based on the highest plausible business impact. Show us the worst-case scenario, but do not cross the line into data destruction.
• Chaining & Post-Exploitation: Chaining vulnerabilities is encouraged to demonstrate impact. However, if you compromise a server or internal system, stop immediately. Do not attempt to pivot, port scan internal networks, or escalate privileges further.
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• Submit one vulnerability per report, unless chaining is required.
• Do not compromise or test DSM accounts that are not your own.
• Do not threaten DSM, engage in extortion, or demand ransom.
• Do not perform brute force, DoS attacks, or any actions that degrade DSM services.
• Social engineering (e.g., phishing, vishing) and physical attacks against DSM facilities are strictly prohibited.
• Employees, contractors, and their immediate families are prohibited from participating.

Out-of-Scope Vulnerabilities & Exclusions

When reporting vulnerabilities, please consider the realistic attack scenario/exploitability, and the technical security impact of the bug. The following issues and testing methods are explicitly excluded from this program:

1. Excluded Assets & Features

• Any non-DSM applications, third-party integrations, or external hostings.
• Submitting domain takeovers. We accept notifications of domain takeover for security purposes, but they are not eligible for financial rewards. Please note that performing the actual takeover of the asset is strictly prohibited.
• 0-day vulnerabilities: 0-day and other CVE vulnerabilities may be reported 45 days after initial publication.

2. Prohibited Testing Methods

• Denial of Service: Any activity that could lead to the disruption of our service (DoS/DDoS).
• Automated Testing: Running high-frequency automated scans, scanner outputs, and bugs found purely via generic automated tools without manual verification.
• Brute Force: Any form of credential, token, or identifier brute forcing.
• Social Engineering: Any form of social engineering attacks (e.g., phishing, vishing, smishing) targeted at DSM personnel, customer support, or customers.
• Physical Attacks: Conducting any kind of physical attack on DSM’s personnel, office properties, logistics infrastructure, or data centers.
• Data Exfiltration: Exfiltrating production or customer data. Please test only the absolute minimum necessary to validate a proof of concept.

3. Web Application Exclusions

• Clickjacking on pages with no sensitive actions or state-changing functions.
• Cross-Site Request Forgery (CSRF) on unauthenticated forms, forms with no sensitive actions, or forms with non-impactful business consequences.
• CORS configurations without a demonstrable, exploitable data-leak scenario.
• Content spoofing, text injection, or host header injection issues without a significant, proven attack vector (e.g., without being able to modify HTML/CSS dynamically).
• Open redirects, unless a distinct, secondary security impact can be demonstrated.
• "Self" exploitation vulnerabilities (e.g., Self-XSS, HTML injection affecting only the local session).
• Flash-based vulnerabilities or legacy Flash-related bugs.
• Comma Separated Values (CSV) injection without demonstrating a downstream server-side exploit.
• Form issues regarding missing autocomplete attributes.

4. Configuration and Defensive Best Practices

• Missing security-related HTTP headers (e.g., X-XSS-Protection, missing CSP policies) which do not lead directly to a practical vulnerability.
• Missing HttpOnly or Secure flags on non-sensitive cookies.
• Missing email best practices (e.g., invalid, incomplete, or missing SPF/DKIM/DMARC records).
• Missing best practices in standard SSL/TLS protocol configurations.
• Software version disclosures, banner grabbing, banner identification issues, descriptive error messages, path disclosures, directory listings, or verbose stack traces without active proof of exploitability.
• Password complexity guidelines or user enumeration findings.
• Exposed API keys (e.g., Google Maps API keys) without a demonstrable, high-impact security risk (such as unauthorized write access or sensitive data exposure). Public client-side API keys are not considered sensitive by default.

5. Environmental & Client-Side Exclusions

• Attacks requiring Man-in-the-Middle (MITM) or prolonged physical access to a user's unlocked device.
• Vulnerabilities only affecting users of severely outdated or unpatched browsers (defined as being more than 2 stable versions behind the latest released stable browser version).
• Vulnerabilities relating to root detection, jailbreak status, or certificate pinning on client applications.
• Vulnerabilities relating to outdated versions of the Android or iOS operating systems.
• Cloudflare public IP leaks.
• Previously known vulnerable third-party libraries without a working, contextual Proof of Concept.

Reporting Requirements

To help our triage team validate your findings quickly, all submissions must meet the following baseline requirements. Reports that fail to provide sufficient documentation will be requested to update their report or may be closed as informative.

1. Clear Summary: Provide a concise title detailing the vulnerability type and the affected asset/endpoint.
2. Detailed Description: Explain the underlying flaw and how it can be abused.
3. Step-by-Step Reproduction Instructions: Clearly outline the steps required to replicate the vulnerability. Write your steps assuming the reader has no contextual background on your approach.
4. Proof of Concept (PoC): Include explicit PoC material. This can include raw HTTP requests/responses, screenshots, or short screen recordings (MP4 format).
5. Impact Evaluation: Describe the realistic security risk and impact this vulnerability poses to DSM or its customers. Avoid speculative or theoretical harm.

Disclosure Policy

• As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from DSM.
• Thank you for joining us in supporting ethical and responsible disclosure. By participating in this program, you agree not to share publicly or privately any details or descriptions of your findings with any third party.
• Follow HackerOne's standard disclosure guidelines.

Confidentiality and Protection of Personal Data

The “Confidential Information” shall include, any information provided by DSM to the Hacker (Bug Bounty Program Participants) but not be limited to any information, whether in written, oral, electronic, or other tangible forms including, without limitation, the forms currently available and those made available by new technologies in future, regarding the financial, commercial, technical, professional, market and product-related and all kinds of personal information to be disclosed.

In principle, DSM does not share personal data with Hacker, and only the Hacker can access personal data based on the legal reason that it is compulsory for the performance of the Articles of Association, limited to the performance of the services provided in the Articles of Association.

If the Hacker accesses personal data that is not necessary for the performance of the Agreement, it will immediately destroy that information and any copies.

If you encounter user information that is not your own in the course of your research, please stop and report this activity to our team so we can investigate. Please report to us what information was accessed and delete the data. Do not save, copy, transfer, or otherwise use this data. Continuing to access another person’s data may be regarded as evidence of a lack of good faith.

Safe Harbor

Please note that we can only consider your activities to be lawful if they are proportionate and the purpose of your actions is consistent with the purpose of this Policy. We explicitly do not exclude that any attempt to intentionally or grossly negligently attack our systems with the intent to harm us and/or compromise the confidentiality, integrity or availability of our data may be pursued with legal action.

Legal

If reports/notifications falling within the scope of this Policy are conveyed through a different channel, your report/notification will not be taken into consideration by our company. Instead, you will be directed to the BugBounty Program to submit your report. According to our company policies and procedures, reviews of reports and notifications are carried out by our technical teams only when they are transmitted within the scope of the BugBounty program. Therefore, it is necessary to submit your reports through this program.

DSM reserves the right to modify the terms and conditions of this program and your participation in the program constitutes acceptance of all terms. Please check this website regularly as we update our program terms and conditions of participation periodically. We reserve the right to terminate this program at any time.

Thank you for keeping DSM and our users safe!