Qoinpay Bug Bounty Program Poin Only

PT Loyalti Program Indonesia

PointsTotal reward

Description

Qoinpay Bug Bounty Program

Qoinpay is the first crypto utilization platform in Indonesia. Helps you to utilize your crypto assets into your everyday tangible products, fast and easy.

Rules

The following requirements must be adhered to in order to participate in Qoinpay’s bounty program:

  • We investigate and respond to all valid reports. Due to the volume of reports we receive, though, we prioritize evaluations based on risk and other factors, and it may take some time before you receive a reply.
  • We determine bounty amounts based on a variety of factors, including (but not limited to) impact, ease of exploitation, and quality of the report. Note that extremely low-risk issues may not qualify for a bounty at all.
  • We seek to pay similar amounts for similar issues, but bounty amounts and qualifying issues may change with time. Past rewards do not necessarily guarantee similar results in the future.
  • In the event of duplicate reports, we award a bounty to the first person to submit an issue. (Capacity determines duplicates and may not share details on the other reports.) A given bounty is only paid to one individual.
  • Your participation in this program must not disrupt or compromise any data that does not belong to you. Any attacks against other users or company data without provable express consent are prohibited and will automatically disqualify you from participating in the program.
  • You must not disclose the issue to the public or a third-party before it has been fixed and prior written consent from Qoinpay.
  • You must comply with any applicable laws and regulations in connection with your participation in this program.
  • Qoinpay’s development team, employees and all other affiliates are not eligible for rewards.

Target info

Scope

The following domains are in the scope of the bug bounty program:
Android: https://play.google.com/store/apps/details?id=id.qoin.crypto

Any design or implementation issue that substantially affects the confidentiality or integrity of user data is likely to be within the scope of the program, this include :

  • SQL Injection
  • Reflected or stored Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • Server-Side Request Forgery (SSRF)
  • File inclusion (Local/Remote)
  • Server-Side Remote Code Execution (RCE)
  • Leakage of sensitive informations
  • Authentication Bypasses
  • Payment Manipulation
  • Directory Traversal Issue
  • Protection Mechanism bypasses (CSRF bypass, etc.)
  • Access Control Issues (Insecure Direct Object Reference Issues, Privilege Escalation, etc)

Out of Scope

Non-Qualifying Vulnerabilities:

  • Shared links leaked through the system clipboard
  • Any URIs leaked because a malicious app has permission to view URIs opened
  • Absence of certificate pinning
  • Sensitive data in URLs/request bodies when protected by TLS
  • User data stored unencrypted on external storage and private directory
  • Lack of obfuscation is out of scope
  • auth secret hard-coded/recoverable in apk
  • Crashes due to malformed Intents sent to exported Activity/Service/BroadcastReceive (exploiting these for sensitive data leakage is commonly in scope) and due to malformed URL Schemes
  • Lack of binary protection control in android app
  • Lack of Exploit mitigations i.e., PIE, ARC, or Stack Canaries
  • Path disclosure in the binary
  • Snapshot/Pasteboard leakage
  • Runtime hacking exploits (exploits only possible in a jailbroken/rooted environment)

Code of Conduct

Qoinpay wants to create a safe business environment and uphold professionalism ethics. For this reason, there are three main aspects that need to be considered by every security researcher who participates in the program on our platform:

  • CONFIDENTIALITY - All reported security vulnerabilities may not be leaked to the public.
  • INTEGRITY - Only reports security issues that are considered valid and do not use the findings of the security vulnerability for destructive purposes. If there are more than 1 report on the same security issue, the first to report that will be considered valid.
  • PROFESSIONALISM - Security researchers are fully responsible for the reported findings and must be contacted if explanatory or complementary information is needed.

Rewards

  • Researcher will get RedStorm Poin

Submission

Though we welcome reporting of non-security issues, please note that only genuine security issues are eligible for rewards. If you have found a vulnerability, we would love to work with you to resolve it:

  • All submission report must go through the ‘Send Report‘ feature of the RedStorm web application by including proof and the method on how to exploit it.
  • All submissions must be made EXCLUSIVELY through RedStorm platform to be eligible for rewards.
  • All submissions related communications must remain within RedStorm or the official RedStorm support channel during the disclosure process.

Reward

This program adheres to the RedStorm Vulnerability Rating Taxonomy for the prioritization/rating of findings. if relevant, the deviations from the VRT shoul be listed here in a markdown table:

P1 POINT REWARD 100
P2 POINT REWARD 50
P3 POINT REWARD 20
P4 POINT REWARD 10
P5 POINT REWARD 5

Targets

In Scope
https://play.google.com/store/apps/details?id=id.qoin.crypto
Android
Out of scope
Data do not exist yet

0

Vulnerabilities rewarded
Latest hall of fame
Copyright © 2018 - RedStorm. All rights reserved.TermsPrivacyContact