Lapak Maboy Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

To ensure that your vulnerability report is considered, please provide clear and detailed instructions on how to reproduce the issue. Additionally, include an attack scenario that describes how the vulnerability can be exploited, along with an assessment of its potential security impact. Accurate information is crucial for evaluating and addressing the report.

- You must comply with the security policy outlined in our Security Policy.
- Include screenshots or screen recordings to clarify your report.
- Provide a brief remediation guide to help us address the vulnerability.
- Ensure the report is submitted confidentially to protect the information.
- If possible, submit files in an encrypted format (e.g., using PGP/GPG) to enhance data security.

Your contribution is invaluable in maintaining the security and integrity of our system. Each report submitted in accordance with the above requirements will be thoroughly reviewed and given full attention by our security team.

Testing Requirements:

We appreciate your participation in our bug bounty program. However, to ensure the security and stability of our system, please adhere to the following testing requirements:

- Do not perform DDoS (Distributed Denial of Service) attacks or any actions that could overload or damage our servers.
- Do not use social engineering techniques to gain access to or obtain sensitive information.
- Do not engage in any activities that could exacerbate server performance or our network infrastructure, including but not limited to excessive exploitation or intensive testing without prior approval.

By complying with these requirements, you help us maintain the integrity and security of our system while allowing us to effectively address any vulnerabilities found.

Possible Awards:

We greatly appreciate your contributions in reporting vulnerabilities to improve the security of our systems. As a token of our appreciation, we offer the following possible rewards for researchers who provide valid and valuable reports:

- Recommendation in the researcher’s profile.
- Mention and display on our hall of fame page.
- Certificate of appreciation for your contribution.
- Opportunity to collaborate further on security projects with us.

We would also like to inform you that, as Lapak Maboy is a small micro business and does not have any sponsors, our bug bounty program does not offer monetary or material rewards. Nevertheless, we hope that the non-material recognition we offer serves as meaningful appreciation for your contributions.

Special Notes:

- Reports must be submitted confidentially and must not be disclosed to any third party without prior written consent from us.
- You must not publicly disclose any information related to the vulnerability until it has been resolved and we have given explicit permission to do so.
- All interactions and communications regarding the vulnerability must be conducted in a confidential manner.
- Ensure that all data related to the vulnerability is handled securely and encrypted where possible.
- Do not access, modify, or delete any data that does not belong to you during your testing.
- Testing should be limited to your own accounts and devices, and should not impact the operation of the system for other users.
- Avoid any actions that could lead to a data breach, unauthorized data access, or violate user privacy.
- Do not share any findings on social media, blogs, or any other public platforms without our consent.
- All testing activities must comply with relevant laws and regulations.
- Provide all findings in a detailed and clear manner to aid in the resolution process.

By adhering to these special notes, you help us ensure that the bug bounty program is conducted in a responsible and secure manner, fostering a collaborative effort to improve the security of our system.

Other Submissions Handling