Zola Managed Bug Bounty

Description

Zola recognizes the importance of security, privacy, and community. We value the input of the security community and welcome the opportunity to collaborate with community members to maintain a high standard for our users and to create a more secure Internet. We take security issues seriously. If you believe you've identified a vulnerability within our products, we would like to know about it. We'll investigate all submissions and do our best to fix issues. Thank you for taking an interest in making the Internet safer! Ratings: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified, in Zola’s sole but reasonable discretion, due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Note: Certain vulnerabilities may exist on multiple endpoints within the same entity and may be considered as duplicates of each other. It is still recommended that you report them, as the team will investigate to see if they are unique. However, please note that subsequent submissions may be marked as Not Applicable to prevent points farming. An example would be create/read/update/delete endpoints for the same entity with IDOR vulnerability.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Zola not listed in the targets section is out of scope, and you agree not to test or otherwise target any out-of-scope targets, domains or properties, including, without limitation, those listed in the “Out of Scope” section below. This includes any/all subdomains not listed above (e.g. subdomains such as help.zola.com would be out of scope, but everything under baby.zola.com , such as baby.zola.com/shop , would be in scope, unless stated otherwise in the Out-Of-Scope section). If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Zola, you can report it to this program. Access: You need a US-based device in order to properly access the iOS mobile application. The Zola Baby Registry application is only available in the US App store. Credentials: To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Focus Areas: XSS SQL Injection Findings on the Mobile targets API Areas of focus from most to least important for Zola are listed below. Please note that this list does not directly correspond to the Bugcrowd Vulnerability Rating Taxonomy. However, subject to some exceptions, the areas of higher priority for Zola are generally associated with increased technical severity under the Bugcrowd Vulnerability Rating Taxonomy. Account takeover Login, session hijacking, cookie management, password reset/update, account invitation workflow, referral workflow Horizontal/lateral authentication bypass PII, financial info, delivery address Vulnerabilities in core products Registry Out-of-Scope Elements and Prohibited Actions Contacting any email listed at https://baby.zola.com/contact-us Inappropriate graphics when testing upload functionality Chat feature Volumetric (1000s of registry items/sizeable files) DDoS/DoS (including application DoS) Findings that only affect cosmetics/aesthetics Network exhaustion Browsers not included in the following list: Edge, Firefox, Chrome, Mobile Chrome, Safari, Mobile Safari - last 2 versions Social engineering attacks of any kind Spam or any other mass distribution to customers, partners, etc. Manipulating any user data or user accounts - researchers should not change or erase any customer data during testing Customer support channels (chat, phone, email, etc.) Any domain/property of Zola not listed in the targets section is out of scope. This includes any/all subdomains not listed above Specific vulnerabilities: Username/Email Enumeration Publicly accessible S3 buckets / objects DNS misconfiguration Mail server misconfiguration Origin IP disclosure Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and, unless required of us by applicable law, we will not initiate or support legal action against you for accidental, non-negligent, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a one-time, limited basis for work done under this program (although we reserve the right to withdraw this waiver at any time if you do not comply with this policy and/or the standard disclosure terms (below)); and Helpful to the overall security of the Internet and conducted in good faith. You are expected, as always, to comply with all applicable laws, and by participating in this program, you agree to do so. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further. This program is subject to this policy and Bugcrowd’s standard disclosure terms . By participating, you agree to these standard disclosure terms, including all terms and conditions referenced therein.

████████████████ (in scope)

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████ (out of scope)

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████