Description

The Coca-Cola Company is proud of our researcher community and the impactful findings they have provided over the years. We are bringing our VDP program to Intigriti to further our community growth and provide some exciting changes around our VDP reward structure. For more information about VDP rewards, please see the FAQ section below.

Bounties

This is a responsible disclosure program without bounties.

Rules of engagement
Not applicable
Not applicable
max. 5 requests/sec
UA-Intigriti

By participating in this program, you agree to:

  • Respect the Community Code of Conduct
  • Respect the Intigriti Terms and Conditions
  • Respect the scope of the program
  • Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)
Domains

Brand Sites

Tier 2
Other

Brand sites owned by The Coca-Cola Company.

Corporate Sites

Tier 2
Other

*.us.coca-cola.com
*.coca-cola.com
*.ko.com
*.testko.com
*.coca-colacompany.com
*.coke.com
*.cokeurl.com
*.tccc-aem.com

Mobile Applications

Tier 2
Other

Publicly Facing Assets Related to The Coca-Cola Company

Tier 2
Other

Researchers are welcome to submit reports on any publicly facing asset(s) attributed to The Coca-Cola Company.

*.cn

Out of scope
Other

All assets located in or related to China are out of scope and reports will not be accepted.

*.na.ko.com

Out of scope
Wildcard

All Coke Stores

Out of scope
Other

Applications or assets related to any Coke Stores.

Coke One North America (CONA)

Out of scope
Other

Any application or asset owned by Coke One North America (CONA)

Food and Beverage Dispensing Devices

Out of scope
Other

Due to the unique nature of these devices (usually present on networks operated by 3rd parties), we do not authorize testing against them.

  • Coca-Cola Freestyle Machines
  • Dasani Purefill Water Dispensers
  • Intelligent Vending Machines
  • Connected Coolers
In scope

We have highlighted some assets above to help focus your testing efforts. However, with the exception of what is listed as explicitly out-of-scope you are welcome and encouraged to submit impactful findings on any asset you can attribute to The Coca-Cola Company or our brands!

We are proud to offer our community such an open scope and hope this will be welcoming for researchers and hacker no matter how new or veteran they might be!

Subdomain Takeover Validation

Once Intigriti's triage team validates a SDTO report, researchers are free to take down their POC.

Out of scope

Application

  • API key disclosure without proven business impact
  • Wordpress usernames disclosure
  • Pre-Auth Account takeover/OAuth squatting
  • Self-XSS that can't be used to exploit other users
  • Verbose messages/files/directory listings without disclosing any sensitive information
  • CORS misconfiguration on non-sensitive endpoints
  • Missing cookie flags
  • Missing security headers
  • Cross-site Request Forgery with no or low impact
  • Presence of autocomplete attribute on web forms
  • Reverse tabnabbing
  • Bypassing rate-limits or the non-existence of rate-limits.
  • Best practices violations (password complexity, expiration, re-use, etc.)
  • Clickjacking without proven impact/unrealistic user interaction
  • CSV Injection
  • Sessions not being invalidated (logout, enabling 2FA, etc.)
  • Tokens leaked to third parties
  • Anything related to email spoofing, SPF, DMARC or DKIM
  • Content injection without being able to modify the HTML
  • Username/email enumeration
  • Email bombing
  • HTTP Request smuggling without any proven impact
  • Homograph attacks
  • XMLRPC enabled
  • Banner grabbing/Version disclosure
  • Not stripping metadata of files
  • Same-site scripting
  • Subdomain takeover without taking over the subdomain
  • Arbitrary file upload without proof of the existence of the uploaded file
  • Blind SSRF without proven business impact (pingbacks aren't sufficient)
  • Disclosed/misconfigured Google Maps API keys
  • Host header injection without proven business impact
  • Redirects involving login or logout
  • Exposed PHP info pages without impact.
  • Broken Link Hijacking

General

  • In case that a reported vulnerability was already known to the company, it will be flagged as a duplicate
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
  • Spam, social engineering and physical intrusion
  • DoS/DDoS attacks or brute force attacks
  • Vulnerabilities that only work on software that no longer receive security updates
  • Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
  • Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
  • Reports that state that software is out of date/vulnerable without a proof-of-concept
  • Reports of email addresses

Mobile

  • Shared links leaked through the system clipboard
  • Any URIs leaked because a malicious app has permission to view URIs opened
  • The absence of certificate pinning
  • Sensitive data in URLs/request bodies when protected by TLS
  • Lack of obfuscation
  • Path disclosure in the binary
  • Lack of jailbreak & root detection
  • Crashes due to malformed URL Schemes
  • Lack of binary protection (anti-debugging) controls, mobile SSL pinning
  • Snapshot/Pasteboard leakage
  • Runtime hacking exploits (exploits only possible in a jailbroken environment)
  • API key leakage used for insensitive activities/actions
Severity assessment

This program follows Intigriti's contextual CVSS standard

Accepted Issues and Severity
When reporting vulnerabilities, please consider attack scenario/exploitability and the security impact of the bug. We may choose not to accept or to modify the severity of submissions in cases where there is no clear exploit chain, these include:

  • "Best Practice" configuration items not part of a functioning exploit chain.
  • Header Issues such as X-Frame-Options, CSP, etc.
  • Cookie Configuration such as Missing "Secure" Flag on non-sensitive cookies or missing HTTPOnly properties.
  • Mail security configurations such as invalid, incomplete, or missing SPF/DKIM/DMARC records.
  • SSL/TLS configurations.
  • Non-Sensitive information disclosures such as software versions, banner identifications, descriptive error messages, descriptive headers (stack traces, application or server errors).
  • Attacks requiring MITM or physical access to a device.
  • Use of vulnerable libraries without an associated working PoC.

However, it is important to note that in some cases a vulnerability's priority will be modified due to its likelihood or impact. In any instance where a vulnerability rating is modified, an explanation will be provided to the researcher - along with the opportunity to make a case for a higher priority.

Please be aware, The Coca-Cola Company uses Adobe Experience Manager for content management for the majority of its consumer facing websites. We accept vulnerability reports for AEM components and configurations, however, in cases where the same component is determined to be vulnerable across multiple AEM websites because of the shared codebase, these will be treated as one unique vulnerability with subsequent reports marked as duplicate.

FAQ

What's new with rewards?!

The Coca-Cola Company believes their researcher and hacker community should be rewarded for their contributions to security program. As a result, we will be offering Coke Store discount codes based on finding severity.

Severity Coke Store Discount Code Amount
Exceptional $250 USD
Critical $150 USD
High $100 USD
Medium $50 USD
Low $25 USD
Informational Keep Trying You'll Get There! :)
Duplicate So Close...

How are discount codes paid out?

On the first of each month TCCC will generate a discount code for each eligible report. Researchers will be sent codes via their reports once the codes have been generated.

Report was closed but I did not receive a code?

Reports will be closed when the vulnerability has been remediated. Your researcher/hacker handle will be noted internally and added to the closed report once the code has been generated.

What if I did not use all of my code for my purchase?

Right now codes are single use, so make it count. We are looking to fix this in the future but right now it's what we have.

Can codes be used for shipping?

No, right now discount codes cannot be used to cover shipping cost. We are working on this I promise.

Do codes have an expiration date?

Yes, 6 months from the time you receive the code.

Can codes be divided into more codes with smaller values?

No

All aboard!
Please log in or sign up on the platform

For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.

It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.

Program specifics
no reputation No collaboration
Researchers
last contributors
logo
logo
logo
logo
logo
logo
leaderboard
logo
logo
logo
logo
logo
logo
Overall stats
submissions received
992
average payout
N/A
accepted submissions
254
total payouts
N/A
Last 90 day response times
avg. time first response
< 2 days
avg. time to decide
+3 weeks
avg. time to triage
< 2 days
Activity
5/19
logo
created a submission
5/19
logo
created a submission
5/18
logo
created a submission
5/18
logo
created a submission
5/18
logo
created a submission
5/18
logo
created a submission
5/18
logo
created a submission
5/18
logo
created a submission
5/18
logo
created a submission
5/18
logo
created a submission