Wisr.com.au Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Wisr wants to find vulnerabilities in its customer-facing API (https://apis.sandbox.wisr.tech/)

Please include a working PoC, attach screenshots, postman collections, and anything else that will make bug verification simple. Remediation guidelines are welcome.

Testing Requirements:

To begin with, please limit yourself to https://apis.sandbox.wisr.tech/

See documentation at https://apis-docs.sandbox.wisr.tech/index.html

Generally speaking, any bug that poses a significant vulnerability to the security or integrity of the Wisr ecosystem could be eligible for a reward. However, it is entirely at our discretion to decide whether a bug is significant enough to be eligible for a reward.

In general, anything which has the potential for financial loss or data breach is of sufficient severity, including

* Implementation bugs that can lead to financial loss
* Access to our production servers
* Remote Code Execution
* Crash bug in our APIs (e.g., a bug that can crash the app by sending a special request, not by sending thousands of requests)

In general, the following would not meet the threshold for severity:

* Recently disclosed 0-day vulnerabilities.
* Vulnerabilities on sites hosted by third parties unless they lead to a vulnerability on the main website
* Vulnerabilities contingent on physical attack, social engineering, spamming, DDOS attack, etc.
* Vulnerabilities affecting outdated or unpatched browsers
Vulnerabilities in third-party applications that make use of Wisr’s APIs
* Bugs that have not been responsibly investigated and reported
* Bugs already known to us or already reported by someone else (reward goes to the first reporter)
* Issues that aren’t reproducible
* Issues that we can’t reasonably be expected to do anything about

Possible Awards:

The Wisr Bug Bounty Panel will evaluate award sizes according to the severity calculated by Open Bug Bounty. However, final awards are determined at the sole discretion of the panel.

Special Notes:

You must discuss any vulnerabilities found with Wisr first.