Jumpseller Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

We are an e-commerce platform that takes care of all the infrastructure so that businesses can focus on selling their products. They do not need any additional software to create an online store.

No technology is perfect, and Jumpseller believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly.

We'll provide rewards to reporters who submit original, in-scope vulnerabilities.

This table outlines the lower bounds for these rewards depending on the level assigned. Each report is assessed based on criticality, impact and risk to our customers and our company.

We may choose to grant bonuses or larger rewards to critical vulnerabilities, more creative exploits, and more insightful reports.

Testing Requirements:

Security researchers can use the landing page of jumpseller.com and create a trial stores.

Properties:
- Admin Panel: store_code.jumpseller.com/admin
- Store-front: store_code.jumpseller.com
- API: https://api.jumpseller.com/v1/path.json?login=XXXXXX&authtoken=XXXXXX
- OAuth2 Server: https://jumpseller.com/support/oauth-2

You can get your login and auth token by creating a store. It's in your Account Options.

Important:
- you're not allowed to use our real merchants stores for this program.
- no social engineering attacks

Possible Awards:

Bounties depend on the severity of the vulnerability:

Low: 25 to 50 USD
Medium: 60 to 150 USD
High: 300 to 500 USD
Critical: 1500 to 2500 USD

Scale according to impact and ingenuity, from an unlikely low-sensitivity XSS to a deep, novel RCE, credentials stuffing, etc

One reward per bug; first discovery claims it; ties break toward the best report.

Known vulnerabilities that we will NOT consider:

- Admin Panel:
-- We are aware that the CSRF token is not enabled in some of our controllers.
-- We don't consider XSS attacks originated from the Admin Panel of the store. Since the administrator can, for example, fully change the HTML of a store-front. However, we do consider XSS attacks from a store-front to the Admin Panel.
-- Emails are not validated, in some instances, for business purposes, leading to possible denial of service.
-- Email flooding

- Jumpseller.com (Landing Page):
-- Click-jacking (UI redress attack), since our CDN does not support custom headers.

- All Properties:
-- Social engineering (e.g. phishing, vishing, smishing)
-- Denial of service
-- Spamming
-- any physical attempts against Jumpseller property is prohibited.

Special Notes:

If you have any questions about Jumpseller service refer to our Documentation: https://jumpseller.com/support and/or contact our support.