In-scope vulnerabilities

The following vulnerabilities are considered in-scope:

• Business logic issues
• Payments manipulation
• Access control issues (e.g., IDOR)
• Remote code execution (RCE)
• Injection vulnerabilities
• Supply chain attack
• Cryptographic vulnerabilities
• Any other vulnerability with a clear potential for loss (such vulnerabilities will be considered at our discretion)

All in-scope vulnerability reports must include a Proof of Concept (PoC) that demonstrates real-world impact. Submissions without a PoC will not be considered.

Out-of-scope vulnerabilities

Vulnerabilities identified in out-of-scope resources are generally not eligible for rewards unless they present a significant business risk, as determined at our sole discretion.

The following items are generally excluded from reward eligibility due to insufficient severity or lack of relevance to the program’s defined scope:

• Recently (less than 30 days) disclosed zero-day vulnerabilities
• Attacks requiring physical access to a user’s device
• Vulnerabilities that require root/jailbreak
• Vulnerabilities requiring extensive user interaction (e.g., social engineering)
• Exposure of non-sensitive data on the device
• Reports from static analysis of the binary without a PoC that impacts business logic
• Lack of obfuscation/binary protection/root (jailbreak) detection
• Bypass certificate pinning on rooted devices
• Lack of exploit mitigations (e.g., PIE, ARC, stack canaries)
• Sensitive data in URLs/request bodies when protected by TLS
• Path disclosure in the binary
• OAuth & app secret hard-coded/recoverable in IPA/APK (unless the critical impact is proven)
• Sensitive information is retained as plaintext in the device’s memory
• Crashes due to malformed URL schemes or Intents sent to exported activity/service/broadcast receiver
• Any kind of sensitive data stored in the app’s private directory
• Runtime hacking exploits (e.g., Frida, Appmon) that require a jailbroken environment
• Shared links leaked through the system clipboard
• Exposure of API keys with no security impact (e.g., Google Maps API keys)
• Theoretical or purely speculative exploits without demonstrated business impact

• AI-generated reports will not be considered
• Automated scanning results will not be considered
• Do not access or modify data belonging to other users
• Non-production vulnerabilities are limited to High severity
• Perform testing only within the scope described in this program
• Do not spam forms or account creation flows using automated tools
• Avoid compromising any personal data, interruption, or degradation of any service
• Do not exploit any DoS/DDoS vulnerabilities, social engineering attacks, or spam methods
• Remain compliant with all applicable laws and operate strictly within the defined testing scope
• Avoid causing any disruption to the availability of products, services, or infrastructure
• Bounty reward is determined by the proportion of potential damage and is limited by a severity rewards range
• Do not share details of any vulnerabilities with anyone outside the authorized team without explicit written permission from the organization

We value all valid reports that help us strengthen our security. To qualify for a monetary reward, the following eligibility conditions must be fulfilled:

• You must be the first reporter of a vulnerability
• The vulnerability must be a qualifying (in-scope) vulnerability
• Any vulnerability found must be reported no later than 24 hours after discovery
• You must send a clear textual description of the report and detailed steps to reproduce the issue. Include attachments such as screenshots or proof-of-concept code if necessary
• You must not be a former or current employee of our company or any of its contractors
• Include clear and concise reproduction steps to help us verify and assess the impact of the reported issue efficiently

• All information related to this program, including any discovered vulnerabilities (resolved or unresolved), must be kept strictly confidential. Public disclosure — including partial disclosure or discussion in any public forum, channel, or platform — is strictly prohibited without the organization's explicit written consent