Purse Bug Bounty Program
IMPORTANT!! We have temporarily suspended the bug bounty program for any vulnerabilities that do not result in loss of user funds as we sunset our current Marketplace. If you have a bug report that does not have a proper proof of concept that demonstrates a loss of funds then we will ignore that bug report.
Purse's Bug Bounty Program allows developers to discover and resolve bugs before the general public is aware of such bugs, preventing incidents of widespread abuse. If you find a security vulnerability on the Purse.io website or API, please let us know right away. Please review the following information before submitting a report:
You’re the first person to responsibly disclose the security vulnerability.
The reported vulnerability could compromise the integrity of user data, circumvent the privacy protections of user data, or enable access to a system within our infrastructure
While investigating vulnerabilities, you made every attempt to use a test account instead of a real account.
While investigating vulnerabilities, you did not cause any service disruption for PurseIO customers. We will still never prosecute you if you caused no damages beyond very short term Denial of Service, however irresponsible testing methods may impact your reward level.
While investigating vulnerabilities, you had no interaction with other accounts without the consent of their owners.
If a security vulnerability is found that meets the above qualifications, please submit a report by contacting us at [email protected]
Provide detailed steps in your message explaining how to reproduce the security vulnerability. This should include any links you clicked on, pages you visited, URLs, user IDs, etc. Provide clear descriptions of any accounts used in your report and the relationships between them.
If you send an image or a video, please keep it short by showing only the necessary parts. Record at a readable resolution. Make sure the language of the video is in English to help us quickly identify the problem. If a large amount of text appears in your video, please include a copy of the text in your message as well. Please keep the video private by uploading it as an attachment.
Rewards for qualifying bugs range from $100 to $10,000 payable in Bitcoin (BTC). The following table outlines the usual rewards chosen for the most common classes of bugs*:
*The final amount is always chosen at the discretion of the reward panel. In particular, we may decide to pay higher rewards for unusually clever or severe vulnerabilities; decide to pay lower rewards for vulnerabilities that require unusual user interaction; decide that a single report actually constitutes multiple bugs; or that multiple reports are so closely related that they only warrant a single reward.
We are committed to responding to any bug reports within 30 days of receipt. We will assess how much time is needed to make the necessary fixes and respond within that 30 day window with the Bounty Reward amount as well as a timeframe for completion and date of payment. Please respect this timeline and be patient.
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
Out of scope domains: support.purse.io, blog.purse.io, status.purse.io, any other domains provided by third party cloud services that are not managed by Purse. We will direct you to the corresponding cloud provider if you do find a vulnerability with these domains, but we will not honor any rewards.
Clickjacking on pages with no sensitive actions
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
Attacks requiring MITM or physical access to a user's device.
Previously known vulnerable libraries without a working Proof of Concept.
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
Missing best practices in SSL/TLS configuration.
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
Rate limiting or bruteforce issues on non-authentication endpoints
Missing best practices in Content Security Policy.
General security best practices (eg: password policies, CSP, etc)
Missing HttpOnly or Secure flags on cookies
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
Tabnabbing
Open redirect - unless an additional security impact can be demonstrated
Issues that require unlikely user interaction
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
About the Bug Bounty Program
Purse's Bug Bounty Program allows developers to discover and resolve bugs before the general public is aware of such bugs, preventing incidents of widespread abuse. If you find a security vulnerability on the Purse.io website or API, please let us know right away. Please review the following information before submitting a report:
Attributes of a Helpful Vulnerability
You’re the first person to responsibly disclose the security vulnerability.
The reported vulnerability could compromise the integrity of user data, circumvent the privacy protections of user data, or enable access to a system within our infrastructure
While investigating vulnerabilities, you made every attempt to use a test account instead of a real account.
While investigating vulnerabilities, you did not cause any service disruption for PurseIO customers. We will still never prosecute you if you caused no damages beyond very short term Denial of Service, however irresponsible testing methods may impact your reward level.
While investigating vulnerabilities, you had no interaction with other accounts without the consent of their owners.
How to Send a Report
If a security vulnerability is found that meets the above qualifications, please submit a report by contacting us at [email protected]
What to Send in a Report
Provide detailed steps in your message explaining how to reproduce the security vulnerability. This should include any links you clicked on, pages you visited, URLs, user IDs, etc. Provide clear descriptions of any accounts used in your report and the relationships between them.
If you send an image or a video, please keep it short by showing only the necessary parts. Record at a readable resolution. Make sure the language of the video is in English to help us quickly identify the problem. If a large amount of text appears in your video, please include a copy of the text in your message as well. Please keep the video private by uploading it as an attachment.
Rewards for qualifying bugs range from $100 to $10,000 payable in Bitcoin (BTC). The following table outlines the usual rewards chosen for the most common classes of bugs*:
*The final amount is always chosen at the discretion of the reward panel. In particular, we may decide to pay higher rewards for unusually clever or severe vulnerabilities; decide to pay lower rewards for vulnerabilities that require unusual user interaction; decide that a single report actually constitutes multiple bugs; or that multiple reports are so closely related that they only warrant a single reward.
Timeline
We are committed to responding to any bug reports within 30 days of receipt. We will assess how much time is needed to make the necessary fixes and respond within that 30 day window with the Bounty Reward amount as well as a timeframe for completion and date of payment. Please respect this timeline and be patient.
Out of scope vulnerabilities
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
Out of scope domains: support.purse.io, blog.purse.io, status.purse.io, any other domains provided by third party cloud services that are not managed by Purse. We will direct you to the corresponding cloud provider if you do find a vulnerability with these domains, but we will not honor any rewards.
Clickjacking on pages with no sensitive actions
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
Attacks requiring MITM or physical access to a user's device.
Previously known vulnerable libraries without a working Proof of Concept.
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
Missing best practices in SSL/TLS configuration.
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
Rate limiting or bruteforce issues on non-authentication endpoints
Missing best practices in Content Security Policy.
General security best practices (eg: password policies, CSP, etc)
Missing HttpOnly or Secure flags on cookies
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
Tabnabbing
Open redirect - unless an additional security impact can be demonstrated
Issues that require unlikely user interaction
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Updated on: 04/07/2023
Thank you!