Bugs and Vulnerabilities

Submission

When you send a report to us we try to send an initial response within 3 weekdays. Within 14 weekdays we try to assess the report and categorize the report. We target to have the issue fixed within 31 days after the report.
After the issue is fixed we will come back to you with the reward.

You can send your report to development at mypup nl. Please send us the following info with the report:

A link to your bug bounty profile.
A description of the issue and impact.
Steps to reproduce the issue.
A possible remediation.
A clear reproducible POC of the issue (see rules of engagement)

Bus or reports that are incomplete (no video, screenshots and/or clear description) and that we cannot reproduce on our own are dismissed and are not eligible for any reward.

In short: if we can't find and fix the bug with the given report, the submission is rendered incomplete.

In scope

Try to primarily focus on our own platform available at login.mypup.nl and app.mypup.nl.

The following domain names are in scope but may refer to third party software:

mypup.nl
mypup.app

Reports on vulnerabilities in third-party software will be rewarded only if a patch has been available for more than 31 days, there is a POC that illustrates impact of it to MyPup and it has a Critical or High impact to MyPup.

Out of scope

The following vulnerabilities are generally considered out of scope:

Brute-force / dictionary attacks.
Non-sensitive Clickjacking.
Non-sensitive CSRF (login / logout).
Vulnerabilities without a POC (Proof of Concept).
Physical access dependent attacks.
MITM dependent attacks.
Best practices in SSL/TLS configuration, implementations etc
Industry standards and policies.
Disruption of the service or to the website (e.g., DoS attacks, mass scans etc).
(API) Rate-limiting issues in general.
Automated reports from tools like nmap, Nessus, ZAP, Burp Scanner, Acunetix etc.
Social engineering attacks.
Public website on my-pup.com. Since it's just a cloud-based CMS we can't do anything about vulnerabilities.
Also the CMS page doesn't store any personal data.

Severity and rewards

We have different rewards depending on the severity and business impact of each report. We categorize the reports using Intigriti’s contextual CVSS standard (v3.1). In the following table you can see the severity categories, the corresponding rewards and the max CVSS score for each severity category.

Severity	Max CVSS	Reward
Exceptional	10.0	€ 1.000,00
Critical	9.4	€725,00
High	8.9	€475,00
Medium	6.9	€ 275,00
Low	3.9	€ 100,00
None	0.0	€ -

We can send rewards using Paypal

Duplicates

For different attack vectors that result in the same mitigation, MyPup reserves the right to reward the first report that is validated for that fix. All subsequent reports that are addressed by that mitigation will be considered as duplicates, regardless of the attack vector. Also bugs that are fixed already and are in the process of being released are also seen as duplicates.

Exceptions and edge cases

Some reports don’t exactly fall inside the CVSS standard. We’ve outlined these exceptions so you know what severity assessment you can expect.

Report Type	Severity	Decription
Duplicate Report	None	Reports that have already been reported by another security researcher. When requested, a proof of the previous report can be sent to the security researcher.
Intended Behaviour	None	Reports about intended behaviour that is not changed will not be rewarded. Note that names and addresses of pick up points are always visible and are intended behavior to be publicly available.
Broken link hijacking (high traffic links)	Low	Exploitation of a broken or inactive link on the site to redirect visitors to malicious or unintended destinations, typically for the purpose of spreading malware, phishing, or promoting spammy content.
Disclosed info/debug page	Low	Status or debug pages like the PHP or CGI status page.
E-mail verification bypass	Low	E-mail verification is not required for the program to function properly (if applicable).
HTML injection in e-mails	Low	An vulnerability where an attacker is able to inject and execute malicious HTML or script code within the body or metadata of an email.
Known Behaviour	Low	Reports about known intended or known behavior, but which results in an update are rewarded, as long as this update is security related.
Open redirect without additional impact	Low	A vulnerability where the site allows user-controlled input to redirect to external URLs, but it does not lead to any further security consequences or compromise user data.
Rate limiting issues without discolsure	Low	Rate limiting issues where no information is disclosed about the end user.
Self-XSS or Reflected HTML injection	Low	Self-XSS reports where users need to input the code themselves and affects the user itself.
Dangling DNS records to risky service	High	Dangling DNS records pointing to an attacker-controllable service or IP address will be rewarded with a Dangling DNS records to risky service,- bounty.
Leaked Enduser Addresses	High	Leaked e-mail addresses of users that use the MyPup platform itself.
Leaked Maintainer Credentials	Critical	Leaked credentials (username + password or totp secret) of maintainer/admin users will be rewarded with a €Leaked Maintainer Credentials bounty.

Rules of engagement

Activity that is disruptive to normal operation will result in disqualification of the report. Examples are:

Generating abuse requests
Submission of support, sales or other requests to 3rd party systems
Mass creation of users, groups, and projects
Typosquatting or other namesquatting
Spam-like or other high volume activity

In general, behave professionally and use authentic reports. Doing any of the following will immediately disqualify the report.

Sending reports from automated tools without verifying them.
Respect our user’s privacy. You must use only test accounts in order to respect our users’ privacy. Do not access private information of other users.
Performing actions should not affect MyPup’s users or operations (e.g. a denial of service or spam)

To demonstrate your impact:

Choose a non disruptive option to demonstrate the vulnerability or bug.
If the only way to demonstrate an impact is a disruptive one then stop and report the issue, we will validate the impact.
In case of reports related to credential leaks do not create additional access credentials using the leaked one. We will determine impact ourselves and award for the maximum impact we uncover.
For sharing POC videos, directly upload or send the video in the report. Do not upload POC videos in public platforms until the report is disclosed.
JavaScript vulnerabilities must be demonstrated with more than just “alert()”.