Open Bug Bounty selected among the
Top 5 Bug Bounty programs to watch
in 2021 by The Hacker News

For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,120,620 coordinated disclosures
715,354 fixed vulnerabilities
1,469 bug bounty programs, 2,936 websites
25,855 researchers, 1,381 honor badges

Together Price Bug Bounty Program

Together Price runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Together Price

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Together Price and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

togetherprice.com
app.togetherprice.com

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Provide detailed but to-the point reproduction steps
Include a clear attack scenario. How will this affect us exactly?

Please do not discuss or post vulnerabilities without our consent (including PoC's on YouTube and Vimeo)

Out of scope:

General
In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate.
Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, may be excluded or be lowered in severity
Spam, social engineering and physical intrusion
DoS/DDoS attacks or brute force attacks.
Vulnerabilities that are limited to non-current browsers (older than 3 versions) will not be accepted
Attacks requiring physical access to a victim’s computer/device, man in the middle or compromised user accounts
Recently disclosed zero-day vulnerabilities in commercial products where no patch or a recent patch (< 2 weeks) is available. We need time to patch our systems just like everyone else - please give us 2 weeks before reporting these types of issues.
Reports that state that software is out of date/vulnerable without a proof-of-concept

Application
Self-XSS that cannot be used to exploit other users
Verbose messages/files/directory listings without disclosing any sensitive information
CORS misconfiguration on non-sensitive endpoints
Missing cookie flags
Missing security headers
Cross-site Request Forgery with no or low impact
Presence of autocomplete attribute on web forms
Reverse tabnabbing
Bypassing rate-limits or the non-existence of rate-limits.
Best practices violations (password complexity, expiration, re-use, etc.)
Clickjacking on pages with no sensitive actions
CSV Injection
Host Header Injection
Sessions not being invalidated (logout, enabling 2FA, ..)
Hyperlink injection/takeovers
Mixed content type issues
Cross-domain referer leakage
Anything related to email spoofing, SPF, DMARC or DKIM
Content injection
Username / email enumeration
E-mail bombing
HTTP Request smuggling without any proven impact
Homograph attacks
XMLRPC enabled
Banner grabbing / Version disclosure
Open ports without an accompanying proof-of-concept demonstrating vulnerability
Weak SSL configurations and SSL/TLS scan reports
Not stripping metadata of images
Disclosing credentials without proven impact
Disclosing API keys without proven impact
Same-site scripting
Subdomain takeover without taken over the subdomain
Arbitrary file upload without proof of the existence of the uploaded file
--------------------------------------------------------------------
Severity assessment:
Exceptional
RCE (Remote Code Execution)

Critical
Access to all customer personal data
SQL injection

High
Stored XSS without user interaction
Privilege escalation
Authentication bypass on critical infrastructure

Medium
XSS
CSRF with a significant impact

Low
XSS that requires lots of user interaction ( > 3 steps)
CSRF with a very limited impact

Testing Requirements:

No harm policy - researcher's should not aim to leverage found bugs to access private data or modify the database/website state (e.g. SQL injection).

Possible Awards:

Low - 50 USD
Medium - up to 150 USD
High - up to 300 USD
Critical - up to 500 USD
Exceptional - up to 1000 USD

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 07.12.2021 avto.net
 07.12.2021 mobile.customs.gov.my
 07.12.2021 yavoriv-rada.gov.ua
 07.12.2021 ceskatelevize.cz
 07.12.2021 archive.org
 07.12.2021 mcor.swd.gov.hk
 07.12.2021 royallib.com
 07.12.2021 unicaen.fr
 06.12.2021 yallamotor.com

  Latest Blog Posts

11.11.2021 by mistry4592
The Most used Chrome Extensions are Used For Penetration Testing.
08.10.2021 by NNeuchi
How I Found My First Bug Reflected Xss On PIA.GOV.PH(Philippine Information Agency)
26.08.2021 by PyaePhyoThu98
eG Manager v7.1.2: Improper Access Control lead to Remote Code Execution (CVE-2020-8591)
14.07.2021 by Open Bug Bounty
Interview With Open Bug Bounty
25.05.2021 by 0xrocky
Google XSS Game

  Recent Recommendations

@EplayerTv     1 December, 2021
    Twitter EplayerTv:
Very good researcher, also provides clear instructions how to easily fix issue.
@martin_ouwehand     30 November, 2021
    Twitter martin_ouwehand:
We thank KhanJanny for his responsible disclosure of an XSS in one of our Web sites
@Securityteam11     29 November, 2021
    Twitter Securityteam11:
Indrakant notified us responsibly in relation to an issue with one of our websites. Upon seeking further information. his response was prompt and thorough. Thank you Indrakant great effort.
@chrisbeach     29 November, 2021
    Twitter chrisbeach:
Helped me fix a bug on my site - thanks joe-grizzly!
@chrisbeach     27 November, 2021
    Twitter chrisbeach:
Thanks very much for reporting a bug in my website