erihla Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Submit a detailed Proof of Concept (PoC) demonstrating the vulnerability with reproducible steps.
Include a CVSS score to help prioritize severity.
Attach screenshots or video evidence showing the exploit in action.
Provide clear remediation guidelines or suggested fixes.
Ensure reports are well-structured and easy to understand.
Focus on vulnerabilities related to eSIM activation, payment processing, and account security.
Avoid submitting duplicate or previously reported issues.

Testing Requirements:

Testing is limited to non-intrusive methods only.
Do not perform Denial of Service (DoS) attacks or any activity disrupting live services.
Avoid social engineering tactics, including phishing or impersonation.
Focus testing on critical components like payment flows, user authentication, and eSIM activation APIs.
Limit testing to non-peak hours to avoid user disruption.
Automated vulnerability scanners are allowed but must not overload servers.
Respect user privacy and avoid accessing sensitive customer data.

Possible Awards:

Up to $100 for critical vulnerabilities affecting payments, authentication, or sensitive data.
Up to $50 for high-risk findings related to eSIM activation and account security.
Valid findings will earn a place in the erihla LTD Hall of Fame.
Additional rewards may include branded merchandise, t-shirts, or certificates.
Special acknowledgment for exceptional contributions to system security.