Tiqets.com Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Provide your name, email address, and/or telephone number.

Reporting under a pseudonym is always possible, but please ensure that we can contact you in case we have additional questions.

Provide sufficient information to reproduce the problem, so our security team can resolve it as quickly as possible. Usually, the IP address or the URL of the affected system and a description of the vulnerability will be sufficient, but complex vulnerabilities may require further explanation.

Erase all data obtained through the vulnerability as soon as it is reported to our security team.

Read our guidelines below.

Testing Requirements:

Do not reveal the problem to others until it has been resolved.

Do not take advantage of the vulnerability or problem you have discovered by unnecessarily copying, deleting, adapting or viewing data, or by downloading more data than necessary to demonstrate the vulnerability.

Do not generate a lot of unpaid orders.

If you manage to book a ticket for free, you should not continue to book more tickets.

In the event that you bypass our security systems, do not make changes.

Do not generate a flood of errors in our monitoring by excessively using automated scanning tools.

Possible Awards:

As a token of our gratitude for your assistance, we may offer a reward for reports of security problems that are not yet known to us.
The amount of the reward will be determined based on the severity of the leak and the quality of the report.

We don't reward without prior review by our security team.

Special Notes:

Non-qualifying bugs:

- Automated scan reports
- Open HTTP redirections
- Missing HTTP security headers and cookie flags on insensitive cookies
- Rate-limit or brute-force attacks
- DoS or DDoS attacks
- Phishing or spam attacks (including SPF/DKIM/DMARC-related issues)
- Vulnerabilities found in third-party services
- Issues requiring direct physical access to the victim’s machine or device
- Placing malware (virus, worm, Trojan horse, etc.).

Other Submissions Handling