Description

Oda.com and Mathem.se is the leading online grocery storesin Norway and Sweden.

Bounties
Low
0.1 - 3.9
Medium
4.0 - 6.9
High
7.0 - 8.9
Critical
9.0 - 9.4
Exceptional
9.5 - 10.0
Tier 2
100
400
1,500
3,000
4,000
Tier 2
€100 - €4,000
Tier 3
75
250
750
2,000
2,500
Tier 3
€75 - €2,500
Rules of engagement
Required
include intigriti:<username>
max. 5 requests /sec
Not applicable

**Please note that we have Fastly WAF in the front of our apps. If you are too aggressive the WAF may block you and you'll start getting 403s back. **

Refrain from using the chat and talking to the customer service. The chat is a third-party system and is not in scope for the program.

By participating in this program, you agree to:

  • Employees of Oda and contractors are not allowed to participate to this program.
  • Respect the Community Code of Conduct
  • Respect the Intigriti Terms and Conditions
  • Respect the scope of the program
  • Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

User-agent and rate limit

Add your username to the user-agent so that we are able to distinguish your traffic from malicious traffic.

Domains
iOS

Oda android app

The main shop used in Norway.

The Oda android app

Severity assessment

This program follows Intigriti's contextual CVSS standard

Cool-down period for zero-days
Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty.

FAQ

Where can we get credentials for the app?

You can self-register on the application but please don’t forget to use your @intigriti.me address. You can use the address and the phone number if you want.

Address - (Oda HQ)
Kjølberggata 31,
0653 Oslo, Norway

Telephone number
+4722495494

Which languages is Oda available in?

Oda is currently available in Norwegian

I'm getting HTTP 403

We are using Fastly Web Application Firewall (WAF) in front of our shops. Please adjust your testing method to avoid getting blocked.

All aboard!
Please log in or sign up on the platform

For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.

It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.