By participating in this program, you agree to:

• Respect the Community Code of Conduct
• Respect the Intigriti Terms and Conditions
• Respect the scope of the program
• Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

Validation times

This remains at the discretion of mateco to award.

In-Scope Assets and Testing Guidelines

The assets listed in this scope include production services that are currently publicly accessible. Some of these services are planned to become accessible only through our internal network/VPN, while our customer-facing services will remain publicly accessible.

Services transitioning to internal access

Some production services currently accessible from the public Internet are planned to become accessible only through our internal network/VPN.

Some of these services are protected by authentication, while others are intentionally accessible without authentication.

Authenticated services

For services that require authentication, successfully demonstrating that authentication can be bypassed and that the protected application or API can be accessed is sufficient to report a vulnerability.

Researchers are asked not to continue testing beyond the point necessary to demonstrate the authentication bypass. In particular, please do not attempt to access, modify, delete, or extract sensitive data, execute additional privileged functionality, or otherwise disrupt the platform after demonstrating that authentication can be circumvented.

Health, readiness, liveness, monitoring, and other endpoints that are intentionally exposed without authentication are excluded from this requirement.

Unauthenticated services

For services that are intentionally accessible without authentication, the absence of authentication itself is not considered a vulnerability. A report must demonstrate an additional security impact or vulnerability, such as unauthorized access to data or functionality, an authorization bypass, injection, or another security issue.

Customer-Facing Services

Our customer-facing production services will remain publicly accessible and are therefore included in the VDP.

The same testing principles apply to these services:

• For a service that requires authentication, demonstrating an authentication bypass is sufficient to report a vulnerability.
• For a service that is intentionally accessible without authentication, the absence of authentication itself is not considered a vulnerability. An additional security impact must be demonstrated.
• Health, readiness, liveness, monitoring, and other intentionally public endpoints are excluded from this requirement.
• Researchers must not continue exploitation beyond what is necessary to demonstrate the vulnerability.
• Researchers must only access data belonging to other users or customers if needed for proof of vulnerability.
• Researchers must not modify, delete, or extract data belonging to other users or customers.

Account access

Some customer-facing services normally support user account creation. However, account creation is not available for the services covered by this VDP.

Researchers should not attempt to circumvent this restriction or obtain authenticated access through unintended means for the purpose of conducting further testing.

If you require an authenticated account to perform additional testing, or if you would like to investigate the impact of a vulnerability beyond the minimum proof required for this VDP, please request to participate in our separate Intigriti bug bounty program. Additional testing should only be performed within the scope and rules of that program.

Responsible Testing

Our VDP is intended to identify security vulnerabilities while minimizing any potential impact to our production environment.

Once you have demonstrated a vulnerability sufficiently for us to understand and reproduce it, please stop testing. In particular, do not continue exploitation to demonstrate additional impact if doing so could affect the availability, confidentiality, or integrity of our systems or customer data.

If you wish to perform more extensive testing or demonstrate additional impact, please request access to our separate Intigriti bug bounty program.

The following findings and activities are out of scope for this Vulnerability Disclosure Program:

Application

• WordPress username disclosure.
• Self-XSS that cannot be used to exploit other users.
• Verbose error messages, files, or directory listings without disclosure of sensitive information.
• CORS misconfiguration on non-sensitive endpoints.
• Missing cookie security flags.
• Missing security headers.
• Cross-Site Request Forgery (CSRF) with no or low impact.
• Presence of the autocomplete attribute on web forms.
• Reverse tabnabbing.
• Bypassing rate limits or the absence of rate limits.
• Best-practice violations such as password complexity, expiration, or reuse policies.
• Clickjacking without demonstrated impact or requiring unrealistic user interaction.
• CSV injection.
• Sessions not being invalidated after logout, enabling 2FA, or similar actions.
• Tokens leaked to third parties without demonstrated security impact.
• Email spoofing, SPF, DMARC, or DKIM issues.
• Content injection without the ability to modify HTML or achieve meaningful impact.
• Username or email enumeration.
• Email bombing.
• HTTP Request Smuggling without demonstrated impact.
• Homograph attacks.
• XML-RPC being enabled.
• Banner grabbing or version disclosure.
• Failure to strip metadata from files.
• Same-Site Scripting.
• Subdomain takeover without successfully taking over the subdomain.
• Arbitrary file upload without proof that the uploaded file can be accessed or otherwise used.
• Blind SSRF without demonstrated business impact; pingbacks alone are not sufficient.
• Disclosed or misconfigured Google Maps API keys without demonstrated security impact.
• Host header injection without demonstrated business impact.
• Health, readiness, liveness, monitoring, and similar endpoints that are intentionally exposed without authentication, provided they do not expose sensitive information or functionality.

General

• Vulnerabilities already known to the company through its own testing or other sources will be treated as duplicates.
• Theoretical security issues without a realistic exploit scenario or attack surface.
• Issues requiring complex or unrealistic end-user interaction to exploit.
• Spam, social engineering, and physical intrusion.
• Denial-of-Service (DoS), Distributed Denial-of-Service (DDoS), or brute-force attacks.
• Vulnerabilities that only affect software or components that no longer receive security updates.
• Attacks requiring physical access to a victim's device, a man-in-the-middle position, or a compromised user account.
• Recently discovered zero-day vulnerabilities reported within 14 days after the public release of a patch or mitigation may be reported but are generally not eligible for a bounty.
• Reports stating that software is outdated or vulnerable without a proof of concept.
• Further exploitation beyond what is necessary to demonstrate an authentication bypass or other vulnerability, including accessing, modifying, deleting, or extracting sensitive data.
• Testing intended to cause damage, disruption, or degradation of production services.
• Attempting to obtain or create authenticated accounts on services where account creation is not available through this VDP.
• Testing that requires authenticated access or extended exploitation beyond the limitations of this VDP; researchers should request access to the separate Intigriti bug bounty program for such testing.

Mobile

• Shared links leaked through the system clipboard.
• URIs leaked because a malicious application has permission to view opened URIs.
• Absence of certificate pinning.
• Sensitive data in URLs or request bodies when protected by TLS.
• Lack of application obfuscation.
• Path disclosure in the application binary.
• Lack of jailbreak or root detection.
• Crashes caused by malformed URL schemes.
• Lack of binary protection or anti-debugging controls, including mobile SSL pinning issues.
• Snapshot or pasteboard leakage.
• Runtime hacking exploits that are only possible on jailbroken or rooted devices.
• API key leakage used only for non-sensitive activities or actions.

This program follows Intigriti's triage standards based on the proof of concept.

Where can we get credentials for the app?
No credentials need to be used. If you want to work with credential, you can please a request to join our intigriti bug bounty program.