Guidelines

• Provide detailed but to-the point reproduction steps
• Include a clear attack scenario, a step by step guide in the PoC is highly appreciated
• Remember: quality over quantity!

It will be the responsibility of intigriti to pay ethical hackers in a timely and legal way. Payouts will only take place after agreement with Delen Private Bank on the criticality of the impact and only if the submission was the first of its kind and agreed to be valid.

Exceptional

• Access to sensitive client data
• Full database access

Critical

• Remote Code Execution
• Access to sensitive user/employee data
• SQLi
• Full privileged access to an important asset of the infrastructure
• Ability to make transactions/orders

High

• Stored XSS
• Access to random customer's data

Medium

Vulnerabilities that affect multiple users, and require little or no user interaction to trigger:

• XSS (single click)

Low

• Debug stack trace
• XSS with complicated scenario's
• Open redirects with possible security impact

Test accounts

Test accounts are not given at this moment. All testing should assume black-box testing. Of course if you find credentials on other places that might give you more access to our systems, we'd love to hear about it!