Żabka Group is the ultimate convenience ecosystem that aims to make people’s lives easier. We accompany consumers at every moment of the day, freeing up their time through the possibility of convenient grocery shopping, have a hot meal on the go, send a package, withdraw cash or take advantage of a dietary catering with delivery. We are aware, that despite our greatest efforts, our knowledge may not be sufficent to keep us safe. Therefore we started our vulnerability disclosure program because we believe that working closely with skilled security researchers is beneficial to for all parties.
This is a responsible disclosure program without bounties.
Here at Zabka Group we take security very seriously. We are aware, that despite our greatest efforts, our knowledge may not be sufficient to keep us safe. Therefore we invite you, to help us because we believe that working closely with skilled security researchers is beneficial for all parties.
We do not offer any rewards in our Vulnerability Disclosure Program. For selected assets we run a private Bug Bounty program. Reports submitted to VDP will not qualify for bug bounty programs.
We are specifically interested in:
This program follows Intigriti's contextual CVSS standard.
You can self-register to some of our apps (Zappka, Dielty, Maczfit, Jush). Unfortunately, we do not offer test credentials for the rest of our applications.
We do have a WAF in front of some of our endpoints. Please lower the rate of requests sent.
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.
