bokadirekt.se Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Vulnerabilities in Bokadirekt's products and services are only within the scope of the Bug Bounty Scheme when they meet the following conditions:

They have not been previously reported or have not already been discovered by our own internal procedures;
It can be demonstrated that there would be a real impact to Bokadirekt,, its users or its customers should the vulnerability reported be exploited by a malicious actor. The existence of a vulnerability does not necessarily demonstrate that such a potential impact exists: theoretical impacts will not be considered within the scope of the scheme;
It exists within a domain that has a security.txt file in its root. Subdomains are considered in the scope provided their parent domain is in scope. (i.e. the existence of https://<bokadirekt.se>/security.txt means that app.bokadirekt.se and www.bokadirekt.se are also in scope.)

Testing Requirements:

The following is out of scope and should not be performed:

- Volumetric/Denial of Service vulnerabilities (i.e. simply overwhelming our service with a high volume of requests);
- TLS configuration weaknesses (e.g. “weak” cipher suite support, TLS1.0 support, sweet32, etc.);
- Reports indicating that our services do not fully align with “best practice” (e.g. missing security headers or suboptimal email-related configurations such as SPF, DMARC, etc.);
- Issues surrounding the verification of email addresses used to create user accounts;
- Clickjacking vulnerabilities;
- Self XSS / DOM Based XSS (i.e. where a user would need to be tricked into pasting code into their web browser);
- CSRF where the resulting impact is minimal;
- CRLF attacks where the resulting impact is minimal;
- Host header injection where the resulting impact is minimal;
- Network data enumeration techniques (e.g. banner grabbing, existence of publicly available server diagnostic pages);
- Reports of improper session management/session fixation vulnerabilities.
- Social engineering or phishing attacks against employees or customers.

Possible Awards:

For confirmed problems we will recommend on your profile and hall of fame.
For very critical problems a monetary reward up to $500 may be awarded.
How critical a problem is deemed to be will be up to Bokadirekt to determine and will be based on the severity of the problem, the impact and other related points.