USAA

Description

USAA appreciates and supports engagement with security community when potential security vulnerabilities in our digital assets are reported to us in accordance with Responsible Disclosure policy. Our mission is to empower our members to achieve financial security through highly competitive products, exceptional service and trusted advice. We seek to be the #1 choice for the military community and their families. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Any domain/property of USAA not listed in the targets section is out of scope. This includes any/all subdomains not specifically listed. Access: iOS : Here Android : Here Credentials: Please create your own accounts on our main site for testing. Identity is not immediately validated, but response values are checked to ensure they are in a valid range. Rules: Please follow Bugcrowd Standard Disclosure Terms Do not contact USAA through any member channels, keep communications within the Bugcrowd Platform. Do not make any attempts to phish members or employees. Submit detailed reproduction steps. Reports based only on automated tool/scanner results or which describe theoretical attack vectors without proof of exploitability will not be accepted. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder. USAA employees, USAA contractors, or USAA suppliers or any persons related to or otherwise affiliated with USAA employees or contractors or suppliers may not submit to this program . Note : Excessive scan traffic may result in automated blocking Focus Areas: Authentication mechanisms Privilege escalation (horizontal or vertical) SQL or command injection Cross-site scripting Remote Code Execution Cross-Site Request Forgery Information Disclosure Security Decisions via Untrusted Inputs Report Criteria: Leverage the following aspects to expedite the review of your submission an d increase the liklihood of recieving the high end of the reward range on your vulnerability report! Business Impact answer the question how does this affect USAA? Quality Report Clear steps to reproduce Working proof of concept Discoverability Answer the question how likely is this to be discovered? Exploitability Answer the question how likely is this to be exploited? Out-of-Scope Vulnerabilities/Best Practices Findings related to SPF records Findings that originate via the Wayback Machine Denial-of-Service Vulnerabilities Brute Force Vulnerabilities Anything requiring old browsers/old plugins/end-of-life software browsers Vulnerabilities which require physical access to a user's device Non-sensitive information available via our Content Delivery Network or on USAA Member Community sites. Clickjacking type Vulnerabilities

High Priority Targets (in scope)

Target Information The USAA application is used by millions of active duty military, veterans and their spouses across the country for both insurance and banking needs.