angel test Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Vulnerabilities should be verified as authentic, and not simply automated results (Nessus, Acunetix etc.).

Qualifying Vulnerabilities:
- Cross-Site Scripting (XSS)
- Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
- Authentication and Authorization Flaws
- Cross-Site Request Forgery (CSRF)
- Remote Code Execution (RCE)
- Code injections (HTML, JS, SQL, PHP, etc.)
- Insecure direct object references
- CORS
- Directory Traversal
- Privilege Escalation



Non-Qualifying Vulnerabilities:
- Vulnerabilities related to CleverTap marketing webpage: https://clevertap.com/
- Reports from automated scanners without appropriate analysis or demonstration of security impacts
- Reports about outdated/vulnerable software without exploitation examples
- Self-XSS affecting only current user
- Missing CSRF token in forms, where sensitive information like user data cannot be modified (e.g. logout form)
- Issues related to contact forms
- Session hijacking, session timeout
- Missing security HTTP headers (X-Frame-*, X-Content-*, CSP, HSTS, HPKP)
- Missing "HttpOnly", "secure", "SameSite" flags for non-sensitive cookies
- Mixed content warnings
- Missing SPF, DKIM, DMARC records
- TLS Cyphers, DNS CA, TLS/SSL best practices
- Possibilities for exhaustive search by user/item identifiers
- Clickjacking/UI redressing
- Software version disclosure
- Stack traces or path disclosure
- Physical or social engineering attempts
- Recently disclosed 0-day vulnerabilities
- Issues that require physical access to a victim's computer/device

Testing Requirements:

No testing requirements

Possible Awards:

Currently only Kudos.

Special Notes:

Vulnerabilities should be verified as authentic, and not simply automated results.

We ask you to abide by the following guidelines:
* Do not report vulrabilities for CleverTap marketing webpgae: https://clevertap.com/
* Unless CleverTap permits you, do not disclose any issues to the public, or any third party.
* Unless CleverTap permits you, do not publish any report submitted concerning this program.
* If you have questions on timelines (to remediation, bounty, etc.), please ask directly in the relevant report.

For more information about CleverTap please follow the link to our Trust Portal: https://security.clevertap.com/