{"title":"DANA Bug Bounty Program","slug":"dana-bug-bounty-program","rules":"# DANA\nDANA Wallet is an e-wallet provider in Indonesia. It began operation in July 2017. DANA Wallet Indonesia's headquarter is in Jakarta, Indonesia.\n\nPay for anything & everything with just a tap of your finger. Experience the convenience of carrying out transactions with ease; from bills, e-commerce payments, to barcode scans in merchants.  #GantiDompet now & switch to DANA Digital wallet for faster, safer & more practical payment methods.\n\n\n# Program Rules\nThank you for your interest in the DANA bug bounty program.\n\n- We believe that no technology is perfect and that working with skilled security researchers is crucial in identifying weaknesses in our systems.\n- If you believe you've found a security bug in our service, we are happy to work with you to resolve the issue promptly and ensure you are fairly rewarded for your discovery.\n- Any type of denial of service attacks is strictly forbidden, as well as any interference with network equipment and DANA infrastructure.\n\n# Special Case (Up to USD $5000)\nEligible vulnerabilities include:\n- Account Takeover (ATO), including the ability to use another user\u2019s funds.\n- Mass extraction of sensitive user data, such as identity information, unauthorized access to another user\u2019s balance, account details, transaction records.\n- Scraping and Automation Bypass Methods in critical application flows, such as login or registration.\n\n\n# Eligibility and Responsible Disclosure\n\nWe are happy to thank everyone who submits valid reports which help us improve the security of DANA, however only those that meet the following eligibility requirements may receive a monetary reward:\n\n- You must be the first reporter of a vulnerability.\n- The vulnerability must be a qualifying vulnerability (see below).\n- _\"OneFixOneReward\"_: If two or more endpoints use the same codebase and a single fix can be deployed to fix all the different endpoints, **only one endpoint will be considered as eligible for a reward** and other reports will be closed as **Informative**. Regardless, such reports will be reviewed on a case by case basis.\n- You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.\n- You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit yourself about requests per second).\n- You must not leak, manipulate, or destroy any user data.\n- You must not be a former or current employee of DANA or one of its contractor.\n- Every report will be reanalyzed and the severity rating may be subject to change. Severity changes can be increased or decreased from initial report depending on the impact of a vulnerability.\n- No full or partial vulnerability disclosure is allowed. \n- XSS reports must demonstrate meaningful security impact, such as exposure of sensitive user data, access to a usable authentication credential, or an unauthorized action on another user\u2019s account. Proof of JavaScript execution alone is insufficient for reward eligibility. \n\n\n# Testing Policy\n\nPlease test vulnerabilities only against your own accounts. Only use authorized accounts so as not to inadvertently compromise the privacy of our users. \n- Avoid tests that could cause degradation or interruption of our services.\n- Do not use automated scanners or tools that generate large amount of network traffic.\n- Do not leak, manipulate, or destroy any user data or files in any system.\n- Do not copy any files from the system and disclose them.\n\n\n# Known vulnerabilities\nThe following list are known vulnerabilities that are known from previous security testing. They are in the process of being fixed and will not be rewarded.\n- Overly permissive Google API key in application binaries. This is known and will be fixed in a near future release\n- Open Redirect on m.dana.id\n- H5 JSBridge-related issues\n\n# In-Scope Assets \n\n## Core Products:\n\nDANA Android Application https:\/\/play.google.com\/store\/apps\/details?id=id.dana&hl=en   \n\nDANA iOS Application https:\/\/apps.apple.com\/id\/app\/dana\/id1437123008  \n\nDANA Web Application https:\/\/m.dana.id \n\n Endpoint mgs.dana.id\n\n# Rewards Grid \nRewards are given based on CVSS scoring and actual business impact.\n\n| Scope                 | None Severity Vulnerability | Low Severity Vulnerability | Medium Severity Vulnerability | High Severity Vulnerability | Critical Severity Vulnerability |\n|-----------------------|---------------------------------|-----------------------------|---------------------------------|----------------------------|----------------------------|\n| Core Product          | $0                   | $60-300                   | $400-700                         | $800-2000                  | $2100-3000 |\n\n\n# REPORTS OF LEAKS AND EXPOSED CREDENTIALS\nIn the context of this program, we do not accept or reward reports of leaks that are not applicable to our program\u2019s scope and identified outside of our program\u2019s scope.\n\nAlso, in order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behavior (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees\/service providers. Eligible reports will be rewarded according to the \"Core Product\" reward grid.\n\nThis excludes, but is not limited to:\n- Stolen credentials gathered from unidentified sources\n- Exposed credentials that are not applicable on the program\u2019s scope\n- Exposed GitHub\/GitLab (or similar) instance with no direct relation with our program\u2019s scope\n- Exposed secrets (e.g. API tokens\/keys or other technical credentials) that are not directly related to the program\u2019s scope\n- Exposed PII on an out-of-scope asset","rules_html":"<h1>DANA<\/h1>\n<p>DANA Wallet is an e-wallet provider in Indonesia. It began operation in July 2017. DANA Wallet Indonesia's headquarter is in Jakarta, Indonesia.<\/p>\n<p>Pay for anything &amp; everything with just a tap of your finger. Experience the convenience of carrying out transactions with ease; from bills, e-commerce payments, to barcode scans in merchants.  #GantiDompet now &amp; switch to DANA Digital wallet for faster, safer &amp; more practical payment methods.<\/p>\n<h1>Program Rules<\/h1>\n<p>Thank you for your interest in the DANA bug bounty program.<\/p>\n<ul>\n<li>We believe that no technology is perfect and that working with skilled security researchers is crucial in identifying weaknesses in our systems.<\/li>\n<li>If you believe you've found a security bug in our service, we are happy to work with you to resolve the issue promptly and ensure you are fairly rewarded for your discovery.<\/li>\n<li>Any type of denial of service attacks is strictly forbidden, as well as any interference with network equipment and DANA infrastructure.<\/li>\n<\/ul>\n<h1>Special Case (Up to USD $5000)<\/h1>\n<p>Eligible vulnerabilities include:<\/p>\n<ul>\n<li>Account Takeover (ATO), including the ability to use another user\u2019s funds.<\/li>\n<li>Mass extraction of sensitive user data, such as identity information, unauthorized access to another user\u2019s balance, account details, transaction records.<\/li>\n<li>Scraping and Automation Bypass Methods in critical application flows, such as login or registration.<\/li>\n<\/ul>\n<h1>Eligibility and Responsible Disclosure<\/h1>\n<p>We are happy to thank everyone who submits valid reports which help us improve the security of DANA, however only those that meet the following eligibility requirements may receive a monetary reward:<\/p>\n<ul>\n<li>You must be the first reporter of a vulnerability.<\/li>\n<li>The vulnerability must be a qualifying vulnerability (see below).<\/li>\n<li><em>\"OneFixOneReward\"<\/em>: If two or more endpoints use the same codebase and a single fix can be deployed to fix all the different endpoints, <strong>only one endpoint will be considered as eligible for a reward<\/strong> and other reports will be closed as <strong>Informative<\/strong>. Regardless, such reports will be reviewed on a case by case basis.<\/li>\n<li>You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.<\/li>\n<li>You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit yourself about requests per second).<\/li>\n<li>You must not leak, manipulate, or destroy any user data.<\/li>\n<li>You must not be a former or current employee of DANA or one of its contractor.<\/li>\n<li>Every report will be reanalyzed and the severity rating may be subject to change. Severity changes can be increased or decreased from initial report depending on the impact of a vulnerability.<\/li>\n<li>No full or partial vulnerability disclosure is allowed. <\/li>\n<li>XSS reports must demonstrate meaningful security impact, such as exposure of sensitive user data, access to a usable authentication credential, or an unauthorized action on another user\u2019s account. Proof of JavaScript execution alone is insufficient for reward eligibility. <\/li>\n<\/ul>\n<h1>Testing Policy<\/h1>\n<p>Please test vulnerabilities only against your own accounts. Only use authorized accounts so as not to inadvertently compromise the privacy of our users. <\/p>\n<ul>\n<li>Avoid tests that could cause degradation or interruption of our services.<\/li>\n<li>Do not use automated scanners or tools that generate large amount of network traffic.<\/li>\n<li>Do not leak, manipulate, or destroy any user data or files in any system.<\/li>\n<li>Do not copy any files from the system and disclose them.<\/li>\n<\/ul>\n<h1>Known vulnerabilities<\/h1>\n<p>The following list are known vulnerabilities that are known from previous security testing. They are in the process of being fixed and will not be rewarded.<\/p>\n<ul>\n<li>Overly permissive Google API key in application binaries. This is known and will be fixed in a near future release<\/li>\n<li>Open Redirect on m.dana.id<\/li>\n<li>H5 JSBridge-related issues<\/li>\n<\/ul>\n<h1>In-Scope Assets<\/h1>\n<h2>Core Products:<\/h2>\n<p>DANA Android Application https:\/\/play.google.com\/store\/apps\/details?id=id.dana&amp;hl=en   <\/p>\n<p>DANA iOS Application https:\/\/apps.apple.com\/id\/app\/dana\/id1437123008  <\/p>\n<p>DANA Web Application https:\/\/m.dana.id <\/p>\n<p>Endpoint mgs.dana.id<\/p>\n<h1>Rewards Grid<\/h1>\n<p>Rewards are given based on CVSS scoring and actual business impact.<\/p>\n<table>\n<thead>\n<tr>\n<th>Scope<\/th>\n<th>None Severity Vulnerability<\/th>\n<th>Low Severity Vulnerability<\/th>\n<th>Medium Severity Vulnerability<\/th>\n<th>High Severity Vulnerability<\/th>\n<th>Critical Severity Vulnerability<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Core Product<\/td>\n<td>$0<\/td>\n<td>$60-300<\/td>\n<td>$400-700<\/td>\n<td>$800-2000<\/td>\n<td>$2100-3000<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h1>REPORTS OF LEAKS AND EXPOSED CREDENTIALS<\/h1>\n<p>In the context of this program, we do not accept or reward reports of leaks that are not applicable to our program\u2019s scope and identified outside of our program\u2019s scope.<\/p>\n<p>Also, in order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behavior (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees\/service providers. Eligible reports will be rewarded according to the \"Core Product\" reward grid.<\/p>\n<p>This excludes, but is not limited to:<\/p>\n<ul>\n<li>Stolen credentials gathered from unidentified sources<\/li>\n<li>Exposed credentials that are not applicable on the program\u2019s scope<\/li>\n<li>Exposed GitHub\/GitLab (or similar) instance with no direct relation with our program\u2019s scope<\/li>\n<li>Exposed secrets (e.g. API tokens\/keys or other technical credentials) that are not directly related to the program\u2019s scope<\/li>\n<li>Exposed PII on an out-of-scope asset<\/li>\n<\/ul>","type":"bug-bounty","status":"V","demo":false,"public":true,"bounty":true,"gift":false,"hall_of_fame":false,"hacktivity":false,"report_count_per_scope":false,"report_collaboration_active":true,"pid":null,"secured":false,"triaged":null,"disabled":false,"vdp":false,"reports_count":339,"reports_imported_count":null,"pending_hunter_suggestions_count":0,"bounty_reward_min":0,"bounty_reward_max":3000,"scopes_count":4,"archived":false,"thumbnail":{"name":"1f3d52f8-9425-4b68-afe3-a30b752fa13c","original_name":"dana-meta-logo.png","mime_type":"image\/png","size":24865,"url":"https:\/\/cdn-yeswehack.com\/program\/thumbnail\/1f3d52f8-9425-4b68-afe3-a30b752fa13c"},"event":null,"business_unit":{"name":"DANA Indonesia","slug":"dana-indonesia","description":"DANA is an Indonesian digital wallet that is safe, trusted and reliable anytime, anywhere. With DANA, you can do non-cash and even non-card transactions for your daily needs, from offline payment transactions, to paying bills and installments online. DANA also has many features that make your transaction experience more practical and fast.  DANA as Indonesia\u2019s digital wallet is currently holding a bug bounty program with the scope and rules of the game as written below. Please read it carefully so that your report can be recognized as a valid report.","currency":"USD","already_activate_product":true,"logo":{"name":null,"original_name":null,"mime_type":null,"size":null,"url":null}},"vpn_outbound_ips":null,"id":null,"scopes":[{"scope":"https:\/\/play.google.com\/store\/apps\/details?id=id.dana&hl=en","scope_type":"mobile-application-android","scope_type_name":"Mobile application Android","asset_value":"HIGH","report_count":null},{"scope":"https:\/\/apps.apple.com\/id\/app\/dana\/id1437123008","scope_type":"mobile-application-ios","scope_type_name":"Mobile application IOS","asset_value":"HIGH","report_count":null},{"scope":"m.dana.id","scope_type":"web-application","scope_type_name":"Web application","asset_value":"HIGH","report_count":null},{"scope":"mgs-gw.dana.id","scope_type":"web-application","scope_type_name":"Web application","asset_value":"HIGH","report_count":null}],"out_of_scope":["webdev.dana.id","wp.dana.id","fiat.dana.id","cmsdev.dana.id","techops.dana.id","dm.dana.id","encrypt.dana.id","*.dana.id","Dev, Test, SIT, Staging, Sandbox, Demo, and other non-production environments"],"qualifying_vulnerability":["Business logic vulnerability with real security impact","Authentication bypass & broken authentication","Horizontal and vertical privilege escalation","Code injections (HTML, JS, SQL, PHP, ...)","Remote Code Execution (RCE)","Cross-Site Scripting (XSS) with real security impact","CORS with real security impact","Cross-site Request Forgery (CSRF) with real security impact","Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)","Insecure Direct Object References (IDOR)","Sensitive Information Exposure through insecure data storage on device","Bypassing Verification Methods"],"non_qualifying_vulnerability":["Lack of expiration on auth tokens","Vulnerabilities affecting outdated versions - we only consider reports in the latest versions of our application that are currently in the Google Play\/Apple Play Stores","Exploiting a generic Android or iOS vulnerability","Lack of encryption on internal database\/preference files without real security impact","Exploits that are only possible on a jailbroken device","Denial of Service (DoS) attacks","Self XSS","\"HTTP Host Header\" XSS","Missing cookie flags","Mixed content warnings","Lack of HTTP security headers (CSP, X-XSS, etc.)","SSL\/TLS best practices","No rate-limiting enforced","Clickjacking\/UI redressing","Software version disclosure","Stack traces, path disclosure, directory listings, etc","Physical or social engineering attempts like phishing","Recently disclosed 0-day vulnerabilities","Presence of autocomplete attribute on web forms","Issues that require physical access to a victim's mobile device","Logout and other instances of low-severity CSRF","Missing security-related HTTP headers which do not lead directly to a vulnerability","Reports from automated web vulnerability scanners (Acunetix, Vega etc) that has not been validated","Incomplete or missing SPF\/DKIM\/DMARC on mail servers","Security best practices without real security impact","Attacks requiring MITM or physical access to a user's device","Enumeration\/account oracles: possibility to enumerate phone numbers, emails, GUID etc and receive indication that it exists","Subdomain takeover which not included in main scope"],"disclose_bounty_min_reward":null,"disclose_bounty_average_reward":null,"disclose_bounty_max_reward":null,"reward_grid_default":{"bounty_low":0,"bounty_medium":200,"bounty_high":1000,"bounty_critical":2000},"reward_grid_very_low":{"bounty_low":null,"bounty_medium":null,"bounty_high":null,"bounty_critical":null},"reward_grid_low":{"bounty_low":0,"bounty_medium":200,"bounty_high":1000,"bounty_critical":2000},"reward_grid_medium":{"bounty_low":null,"bounty_medium":null,"bounty_high":null,"bounty_critical":null},"reward_grid_high":{"bounty_low":300,"bounty_medium":700,"bounty_high":2000,"bounty_critical":3000},"reward_grid_critical":{"bounty_low":null,"bounty_medium":null,"bounty_high":null,"bounty_critical":null},"tags":null,"vpn_active":false,"vpn_ips":null,"account_access":"- An Indonesian mobile number that can receive SMS is required to create an account and use the mobile application. Please use services such as [Nexmo](https:\/\/developer.nexmo.com\/messaging\/sms\/overview) to obtain one and perform testing.\n- Foreign users can register for a DANA account using an international phone number. They can also top up their balance using an international debit card, such as Visa or Mastercard, or through remittance services.","account_access_html":"<ul>\n<li>An Indonesian mobile number that can receive SMS is required to create an account and use the mobile application. Please use services such as <a href=\"https:\/\/developer.nexmo.com\/messaging\/sms\/overview\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" title=\"https:\/\/developer.nexmo.com\/messaging\/sms\/overview\">Nexmo<\/a> to obtain one and perform testing.<\/li>\n<li>Foreign users can register for a DANA account using an international phone number. They can also top up their balance using an international debit card, such as Visa or Mastercard, or through remittance services.<\/li>\n<\/ul>","user_agent":null,"disable_message":null,"stats":{"max_reward":null,"average_reward":null,"average_first_time_response":1,"total_reports":339,"total_reports_last24_hours":1,"total_reports_last7_days":5,"total_reports_current_month":4},"supported_languages":["GB"],"report_import_nb_max":null,"report_import_line_max":null,"banner":{"name":"1922525f-05cc-47c0-84a7-2894c2182867","original_name":"dana-meta-logo.png","mime_type":"image\/png","size":24865,"url":"https:\/\/cdn-yeswehack.com\/program\/banner\/1922525f-05cc-47c0-84a7-2894c2182867"},"restricted_ips":null,"has_pending_version":null,"rights":["view"],"attachments":null,"hunter_message_enabled":null,"send_hunter_message_validation_required":null,"max_credential_pool_number":null,"videos_attachments_enabled":true,"sla_enabled":null,"sla_grid":null,"systemic_issue_rule_enabled":false,"systemic_issue_rule_grid":{"level1":100,"level2":100,"level3":null,"level4":null,"level5":null,"level6":null},"leakage_rule_enabled":true,"leakage_rule_grid_in_scope":{"fully_in_scope":true,"partially_in_scope":true,"out_of_scope":false},"leakage_rule_grid_out_of_scope":{"fully_in_scope":true,"partially_in_scope":false,"out_of_scope":false},"ywh_triager_user_agent":null,"report_submission_cost":4,"program_metrics":{"report_count":null,"rewards_total_amount":null,"hunter_members_count":null,"active_hunters_count":null,"launched_agentic_campaigns_count":null,"total_agentic_campaigns_count":null,"reports_in_progress_count":null,"reports_in_progress_high_critical_count":null,"reports_assessed_count":null,"reports_assessed_high_critical_count":null,"reports_accepted_count":null,"reports_accepted_high_critical_count":null,"reports_resolved_count":null,"reports_closed_count":null,"computed_at":"2026-11-05T13:35:19+01:00"},"credit_balance":null,"credit_balance_projected":null,"has_history":true,"last_update_at":"2026-11-02T04:47:48+01:00","last_program_version":null}