Vinted Bug Bounty

Description

Vinted's mission is to make second-hand the first choice worldwide by building a sustainable circular model and taking it global. We are an online marketplace where members buy and sell pre-loved items directly with each other, and they trust us with their identity, their money and their home address while they do it. We ran a bug bounty program previously and it worked: 594 submissions, 155 of them valid, a lot of issues fixed before anyone outside noticed. We have moved to Bugcrowd to reach a wider crowd. We have done our best to clean up what we know about — now we would like your help finding what we missed. Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Scope and Rewards Testing is only authorised on the targets listed as in scope. Any domain/property of Vinted not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Vinted, you can report it to us. However, be aware that it might be ineligible for rewards or points-based compensation. Engagement Guidelines We do not accept reports that contain low-effort or AI-generated content. Submissions must demonstrate original analysis, clear understanding of the issue, and actionable detail. Reports lacking meaningful human input will be rejected Researchers must throttle all testing activity to avoid degrading service availability, triggering automated defenses, or negatively impacting other users. Excessive request rates, high-volume scanning, denial-of-service techniques, or other disruptive testing methods are prohibited Potential post-exploitation scenarios: If you believe you've identified a vulnerability that may lead to post-exploitation activity including modification or destruction of data please stop testing and submit your finding. We will work with you to evaluate the vulnerability and award you accordingly for the final impact and severity You are testing on production. Behavior that compromises the stability and integrity of the target(s) is out of scope For example, do not target other users' data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it Report Guidelines Vulnerabilities discovered on multiple paths, endpoints, parameters will be treated as duplicates. This includes findings across different environments (e.g., development, staging, production) unless the impact or exploitation method is materially different. Please submit only one report Reports must contain the role used for testing, a clear explanation of the issue and the security impact along with detailed steps to reproduce it. If the issue cannot be reliably reproduced based on your report, it may be considered ineligible for a reward Reports based only on automated tool/scanner results or which describe theoretical attack vectors without proof of exploitability will not be accepted Do not submit more than one vulnerability per report. In cases where demonstrating impact requires chaining multiple vulnerabilities together, those can be included in the same report as long as the linkage is clearly explained PII & Customer Data Handling Reports, comments, and attachments must not contain customer PII or customer information of any kind. Where evidence genuinely requires the inclusion of such data to demonstrate a vulnerability, engagement owners will provide a private, secure channel for the hand-over.Handle Data Like It’s Yours We operate under strict data privacy regulations, including GDPR. We expect researchers to treat all data with the highest level of care. To maintain compliance and protect our members, please adhere to the following: Accidental Access : If you inadvertently reach another person's data, stop testing immediately. Capture only the absolute minimum evidence required to support your claim. Do not pivot to other records, do not enumerate data, and report the finding immediately. Mandatory Deletion : You are required to delete any member data obtained during your testing. Confirmed deletion is a condition of reward eligibility. Storage & Buckets: Do not download the contents of publicly readable S3 buckets or similar storage mechanisms. If a bucket appears to contain sensitive information, do not attempt to access the contents; instead, log a ticket providing the bucket name and/or folder structure as sufficient evidence of the misconfiguration. Access All targets within the scope are publicly accessible. Credentials To gain access to the applications, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Focus Areas To support your testing, we’ve highlighted several key areas of interest. While we ask that you report any efforts related to these areas, please note that testing is not limited to them. Submissions outside of these focus areas are equally welcomed and appreciated. Business-Logic & Financial Impact We are equally interested in business-logic flaws. This includes any issue that causes reputational damage to a buyer or seller, or enables fraud against our members or Vinted itself. Please note: Depending on the report, these findings may be treated at a higher severity or payout than the raw CVSS score suggests. If your finding does not fit a "textbook" vulnerability class but clearly results in financial loss, please submit it. N-day/Third party 0-day Policy When N-Day bugs are released to the public and can be exploited within our target(s), please let us know immediately. Each report will be reviewed on a case by case basis. Excluded Submission Types General Issues already known to us from our own testing (flagged as duplicate) Theoretical issues with no realistic exploit scenario, or requiring complex end-user interaction Spam, social engineering, physical intrusion DoS / DDoS / brute force Attacks requiring physical device access, MITM, or an already-compromised account Zero-days in in-scope assets within 14 days of a public patch or mitigation may be reported, but are usually not eligible for a bounty "This software is out of date" without a PoC Application API key disclosure without proven business impact Disclosed or misconfigured Google Maps API keys Pre-auth account takeover / OAuth squatting Self-XSS not usable against another member Verbose errors, files or directory listings disclosing nothing sensitive CORS misconfiguration on non-sensitive endpoints Missing cookie flags; missing security headers CSRF with no or low impact autocomplete attribute present on web forms Reverse tabnabbing; same-site scripting; homograph attacks Rate-limit bypass or absence of rate limits Password-policy best-practice violations Clickjacking without proven impact or requiring unrealistic interaction CSV injection Output of automated scanners Sessions not invalidated on logout or 2FA enablement Tokens leaked to third parties Email spoofing, SPF, DMARC, DKIM Username / email enumeration; email bombing HTTP request smuggling without proven impact Host header injection without proven impact XMLRPC enabled; banner grabbing and version disclosure File metadata not stripped Subdomain takeover without actually taking over the subdomain Arbitrary file upload without proof the file exists on the server Blind SSRF without proven business impact (pingbacks are not sufficient) Mobile Shared links leaked via the system clipboard URIs visible to a malicious app with URI-viewing permission Absence of certificate pinning or SSL pinning Sensitive data in URLs or request bodies protected by TLS Lack of obfuscation or anti-debugging controls Path disclosure in the binary Lack of jailbreak / root detection; runtime exploits requiring a jailbroken device Crashes from malformed URL schemes Snapshot / pasteboard leakage API key leakage used for non-sensitive actions AWS Publicly readable S3 buckets. Several of ours are public by design as caches for the website and other public resources - unless the contents clearly should not be public (personal data, confidential files). If unsure, log a ticket with examples of the folder structure. Do not download the data. Do not touch real members Test only against accounts, listings and orders you own end to end. Need a buyer and a seller? Create both. Do not interact with real members' listings, messages, reviews or orders. Not a favourite, not a follow. Do not buy from or sell to a real member. If a genuine member messages you, explain you are testing and stop. Test listings must be obviously fake, work-appropriate and cheaply priced. Please do not list your flatmate's cat, however available they may be. No bulk creation of listings, accounts or transactions. Find a gap that allows unlimited creation? Stop at the proof and tell us. Out-of-Scope P5 vulnerabilities Availability/volumetric testing e.g.: DoS/DDoS/Network DoS Rate limiting bypass attempts Email bombing flooding Response Times to Submissions We are committed to reviewing every submission fairly and thoroughly. To manage expectations around feedback: Please allow sufficient time for feedback on your submission. Our programs span multiple entities, teams and time zones, and each finding is validated with the relevant internal teams before we respond. Feedback on more complex findings will take a lot longer and will be attended to eventually. Data Handling & Privacy Handle data like it's yours: If you can reach another person's data: stop, capture the minimum evidence needed, do not pivot, and do not enumerate. Report the issue immediately. Data Deletion: You are required to delete any member data obtained during your testing. Confirmed deletion is a condition of reward eligibility. As we are a European company, we are subject to GDPR regulations and must maintain strict data compliance. S3 Buckets: Do not download the contents of publicly readable S3 buckets. If a bucket appears to contain sensitive information, log a ticket with the folder structure as your evidence instead. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorised in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via our Freshdesk Portal before going any further.