{"title":"Sogexia","slug":"sogexia","rules":"Last Update: 2023-07-26 - Detailed consumer \/ business accounts features \n\n\n## Introducing Sogexia\n\nSogexia is the first French fintech acting as innovative payment services operator and manages at international scale a wide range of innovative banking solutions: payment accounts, physical and virtual cards, mobile payment and additional services. Controlled by the ACPR, Sogexia offers its services to consumers, public institutions and businesses from all sectors.\n\nIn concrete terms, we provide our customers with an online bank account they can provision with bank transfers or online payments. This account entitles physical debit cards ownership. Cards can be used in the whole MasterCard network as long as account holds necessary funds.\n\nThere are two permission levels:\n\n- standard level, available right after account creation\n- upgraded level, available after customer's identity is verified\n\nUpgraded level grants extended usage limits and additional services (bank transfers, ...).\n\n## What we'll reward\n\nThis program is targeted at our public account management web application https:\/\/my.sogexia.com and the related mobile applications (iOS and Android) only.\n\nRewards will be valued at our discretion according to our own severity evaluation, we especially value vulnerabilities that could be exploited to:\n\n- trigger funds movement beyond our system's restrictions\n- perform a significant action on behalf of another user\n- gain free access to a normally paid service\n- perform an unauthorised operation without an upgraded account\n- access to users personal data\n\nReports must include a detailed realistic attack scenario. We ask you to explain as clearly as you can what an attacker can actually do using the vulnerability you've discovered. We're not interested in customers injecting javascript alerts but a scenario in which a stored XSS allows an attacker to harvest sensitive data from our customers will be rewarded.\n\n\n## What we won't reward\n\nAll other web apps, including our corporate site www.sogexia.com, our customer support platform support.sogexia.com and cashback services www.sogexiaclub.com are out of scope. If you find a vulnerability on thoses sites, it won't be rewarded (except of course if it allows an actual security breach impacting my.sogexia.com)\n\nMobile vulnerabilities will only be accepted if they target the latest application version on a recent - not jailbroken - OS version (Android >= 8, iOS >= 11).\n\nWe don't plan to pay rewards for finding bugs not directly related to security (500 errors, incorrect display, usability flaws) but feel free to tell us anyway if you find any :-)\n\nWe already know about a few vulnerabilities we don't intend to fix (listed in unqualifying vulnerabilities). Reporting them won't be rewarded unless they give way to another actual vulnerability.\n\nIt's also possible that we've already identified but not yet fixed an issue, you won't be rewarded either in this case.\n\nWe'll only reward the first person to report a vulnerability, if you come next (unless with a different exploitation proof of concept) you won't be rewarded.\n\n\n\n## Responsibility charter\n\nBy participating to this program, you agree:\n\n- not to target a real customer, whether it be physically or virtually and to only use your own test accounts to reach your goals\n- not to impact other customers with your testing\n- not to disclose any vulnerability you may discover until we fix it\n- to give back funds you may have extracted exploiting a vulnerability\n- not to alter data except for what you input yourself\n- not to disclose data you may have extracted from our system\n- to only extract the bare minimum of data needed to prove your point\n- not to edit our system (neither code nor infrastructure)\n- not to leave a backdoor after you've proved your point\n- not to put the system out of service (using DDoS or exploiting a vulnerability)\n- not to put the system under heavy load: refrain from using scanners or don't go beyond 2 requests per second\n\nYou can't participate in this program if you're a former or current Sogexia employee or contractor.\n\nAny failure to comply with this charter could be sanctioned with legal actions.\n\n\n## Our commitments\n\n- We'll review your reports as soon as possible and will keep you updated throughout the whole process\n- We'll do our best to fix reported vulnerabilities in a timely manner\n- Should we decline a report, we'll explain why\n- You'll be free to publicly disclose your discovery as soon as we tell you we fixed it (or don't intend to fix it)\n- Obviously, funds you have **legitimately** provisioned your test accounts with are your property and we'll transfer it back to you if you ask so.\n\n\n## Enrollment\n\nWe invite you to create an account on [https:\/\/www.sogexia.com\/ouvrir-un-compte](https:\/\/www.sogexia.com\/ouvrir-un-compte) and to email us your account username at ```bugbounty@sogexia.com```, so we can provide you with a discount voucher.\n\nPlease note that the below limitations apply:\n\n### European residency required\n\nPlease note that we can only accept customers with a valid European Economic Area address. Since participating in this program starts with creating a customer account, if you can't create an account using your real address, we won't be authorized to verify your identity and upgrade your account.\n\n### Identity verification\n\nWe're legally bound to verify our upgraded customers identity and will require actual documents according to the type of account you're opening.\n\n#### Consumer accounts\n\nYou'll have to provide actual identification documents and proof of address to upgrade your account.\nYou may use a screenshot of your YesWeHack profile (making sure the YesWeHack logo is clearly visible) as proof of income.\n\n#### Business accounts\n\nYou'll have to provide an actual company's certificate of incorporation and articles of association as well as identity documents and proof of address for yourself and any other main associates. \n\n### Free debit card\n\nWhen participating in the program, send us an email at bugbounty@sogexia.com, we'll provide you a discount voucher so that you can order and receive a free physical debit card. This will give you access to additional features.\n\n\n## Features list\n\nA few features are only available to our business customers, additionally there are several features that are not implemented in the same way for our consumer and business accounts so may find a vulnerability that only affects one kind of account.  \n\n### General Features\n\n| Feature               | Consumer | Business | Notes                                                                    |\n|-----------------------|----------|----------|--------------------------------------------------------------------------|\n| Identity verification | x | x | Business accounts are required to provide documents for several entities |\n| Transaction history   | x | x |                                                                          |\n| User preferences      | x | x | |\n| Phone number update   | x | x | |\n| Email address update  | x | x | |\n| postal address update | x | x | |\n\n### Transfers\n\n| Feature                        | Consumer | Business | Notes                                                                    |\n|--------------------------------|----------|----------|--------------------------------------------------------------------------|\n| Add transfer beneficiary       | x | x |                                                                          |\n| Emit a single Transfer         | x | x |                                                                          |\n| Emit several grouped transfers | x | x |                                                                          |\n| Emit an instant transfer       | x | x | Limited to other Sogexia accounts for now                                |\n| Transfers history              | x | x |                                                                          |\n| View Personal IBAN | x | x | |\n| Require a secondary French IBAN | x | x | |\n\n\n### Debit cards\n\n| Feature                   | Consumer | Business | Notes                                                                    |\n|---------------------------|----------|----------|--------------------------------------------------------------------------|\n| Order a debit card        | x | x | Two types of card exist                                                  |\n| Activate a debit card    | x | x |                                                                          |\n| Lock\/Unlock a debit card | x | x |                                                                          |\n| Retreive debit card PIN  | x | x |                                                                          |\n| Unlock debit card PIN    | x | x | After several failed physical attempts                                   |\n\n\n### Credit card deposits\n\n| Feature                        | Consumer | Business | Notes                                                                    |\n|--------------------------------|----------|----------|--------------------------------------------------------------------------|\n| Register a loading credit card | x | |                                                                          |\n| Credit card deposit            | x | x | Consumer accounts must use a previously registered card                  |\n\n### Cash deposits\n\n| Feature                   | Consumer | Business | Notes                                                                    |\n|---------------------------|----------|----------|--------------------------------------------------------------------------|\n| Retreive personal barcode | x | x |                                                                          |\n\n\n### Direct Debits\n\n| Feature             | Consumer | Business | Notes                                                                     |\n|---------------------|----------|----------|---------------------------------------------------------------------------|\n| Direct Debits list  | x        | x        |                                                                           |\n| Provide B2B mandate |          | x | Business accounts can use the core SEPA scheme as well as the B2B scheme  | \n| Revoke core mandate | x        | x | |\n| Revoke B2B mandate  |          | x | |\n| Reject Direct Debit | x        | x | Business accounts can only reject debits that are part of the core scheme |\n\n\n## Changelog\n\n2020-07-10 - Added mobile applications to program scope\n2023-02-23 - Reward amounts raised\n2023-02-23 - New SEPA direct debit feature\n2023-02-23 - New cash deposit feature\n2023-07-23 - New Grouped Transfers feature\n2023-07-23 - New postal address update feature\n2023-07-23 - Added tracking features in iOS and Android apps\n2023-07-23 - Detailed consumer \/ business accounts features","rules_html":"<p>Last Update: 2023-07-26 - Detailed consumer \/ business accounts features <\/p>\n<h2>Introducing Sogexia<\/h2>\n<p>Sogexia is the first French fintech acting as innovative payment services operator and manages at international scale a wide range of innovative banking solutions: payment accounts, physical and virtual cards, mobile payment and additional services. Controlled by the ACPR, Sogexia offers its services to consumers, public institutions and businesses from all sectors.<\/p>\n<p>In concrete terms, we provide our customers with an online bank account they can provision with bank transfers or online payments. This account entitles physical debit cards ownership. Cards can be used in the whole MasterCard network as long as account holds necessary funds.<\/p>\n<p>There are two permission levels:<\/p>\n<ul>\n<li>standard level, available right after account creation<\/li>\n<li>upgraded level, available after customer's identity is verified<\/li>\n<\/ul>\n<p>Upgraded level grants extended usage limits and additional services (bank transfers, ...).<\/p>\n<h2>What we'll reward<\/h2>\n<p>This program is targeted at our public account management web application https:\/\/my.sogexia.com and the related mobile applications (iOS and Android) only.<\/p>\n<p>Rewards will be valued at our discretion according to our own severity evaluation, we especially value vulnerabilities that could be exploited to:<\/p>\n<ul>\n<li>trigger funds movement beyond our system's restrictions<\/li>\n<li>perform a significant action on behalf of another user<\/li>\n<li>gain free access to a normally paid service<\/li>\n<li>perform an unauthorised operation without an upgraded account<\/li>\n<li>access to users personal data<\/li>\n<\/ul>\n<p>Reports must include a detailed realistic attack scenario. We ask you to explain as clearly as you can what an attacker can actually do using the vulnerability you've discovered. We're not interested in customers injecting javascript alerts but a scenario in which a stored XSS allows an attacker to harvest sensitive data from our customers will be rewarded.<\/p>\n<h2>What we won't reward<\/h2>\n<p>All other web apps, including our corporate site www.sogexia.com, our customer support platform support.sogexia.com and cashback services www.sogexiaclub.com are out of scope. If you find a vulnerability on thoses sites, it won't be rewarded (except of course if it allows an actual security breach impacting my.sogexia.com)<\/p>\n<p>Mobile vulnerabilities will only be accepted if they target the latest application version on a recent - not jailbroken - OS version (Android &gt;= 8, iOS &gt;= 11).<\/p>\n<p>We don't plan to pay rewards for finding bugs not directly related to security (500 errors, incorrect display, usability flaws) but feel free to tell us anyway if you find any :-)<\/p>\n<p>We already know about a few vulnerabilities we don't intend to fix (listed in unqualifying vulnerabilities). Reporting them won't be rewarded unless they give way to another actual vulnerability.<\/p>\n<p>It's also possible that we've already identified but not yet fixed an issue, you won't be rewarded either in this case.<\/p>\n<p>We'll only reward the first person to report a vulnerability, if you come next (unless with a different exploitation proof of concept) you won't be rewarded.<\/p>\n<h2>Responsibility charter<\/h2>\n<p>By participating to this program, you agree:<\/p>\n<ul>\n<li>not to target a real customer, whether it be physically or virtually and to only use your own test accounts to reach your goals<\/li>\n<li>not to impact other customers with your testing<\/li>\n<li>not to disclose any vulnerability you may discover until we fix it<\/li>\n<li>to give back funds you may have extracted exploiting a vulnerability<\/li>\n<li>not to alter data except for what you input yourself<\/li>\n<li>not to disclose data you may have extracted from our system<\/li>\n<li>to only extract the bare minimum of data needed to prove your point<\/li>\n<li>not to edit our system (neither code nor infrastructure)<\/li>\n<li>not to leave a backdoor after you've proved your point<\/li>\n<li>not to put the system out of service (using DDoS or exploiting a vulnerability)<\/li>\n<li>not to put the system under heavy load: refrain from using scanners or don't go beyond 2 requests per second<\/li>\n<\/ul>\n<p>You can't participate in this program if you're a former or current Sogexia employee or contractor.<\/p>\n<p>Any failure to comply with this charter could be sanctioned with legal actions.<\/p>\n<h2>Our commitments<\/h2>\n<ul>\n<li>We'll review your reports as soon as possible and will keep you updated throughout the whole process<\/li>\n<li>We'll do our best to fix reported vulnerabilities in a timely manner<\/li>\n<li>Should we decline a report, we'll explain why<\/li>\n<li>You'll be free to publicly disclose your discovery as soon as we tell you we fixed it (or don't intend to fix it)<\/li>\n<li>Obviously, funds you have <strong>legitimately<\/strong> provisioned your test accounts with are your property and we'll transfer it back to you if you ask so.<\/li>\n<\/ul>\n<h2>Enrollment<\/h2>\n<p>We invite you to create an account on <a href=\"https:\/\/www.sogexia.com\/ouvrir-un-compte\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" title=\"https:\/\/www.sogexia.com\/ouvrir-un-compte\">https:\/\/www.sogexia.com\/ouvrir-un-compte<\/a> and to email us your account username at <code>bugbounty@sogexia.com<\/code>, so we can provide you with a discount voucher.<\/p>\n<p>Please note that the below limitations apply:<\/p>\n<h3>European residency required<\/h3>\n<p>Please note that we can only accept customers with a valid European Economic Area address. Since participating in this program starts with creating a customer account, if you can't create an account using your real address, we won't be authorized to verify your identity and upgrade your account.<\/p>\n<h3>Identity verification<\/h3>\n<p>We're legally bound to verify our upgraded customers identity and will require actual documents according to the type of account you're opening.<\/p>\n<h4>Consumer accounts<\/h4>\n<p>You'll have to provide actual identification documents and proof of address to upgrade your account.<br \/>\nYou may use a screenshot of your YesWeHack profile (making sure the YesWeHack logo is clearly visible) as proof of income.<\/p>\n<h4>Business accounts<\/h4>\n<p>You'll have to provide an actual company's certificate of incorporation and articles of association as well as identity documents and proof of address for yourself and any other main associates. <\/p>\n<h3>Free debit card<\/h3>\n<p>When participating in the program, send us an email at bugbounty@sogexia.com, we'll provide you a discount voucher so that you can order and receive a free physical debit card. This will give you access to additional features.<\/p>\n<h2>Features list<\/h2>\n<p>A few features are only available to our business customers, additionally there are several features that are not implemented in the same way for our consumer and business accounts so may find a vulnerability that only affects one kind of account.  <\/p>\n<h3>General Features<\/h3>\n<table>\n<thead>\n<tr>\n<th>Feature<\/th>\n<th>Consumer<\/th>\n<th>Business<\/th>\n<th>Notes<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Identity verification<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td>Business accounts are required to provide documents for several entities<\/td>\n<\/tr>\n<tr>\n<td>Transaction history<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>User preferences<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Phone number update<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Email address update<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>postal address update<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Transfers<\/h3>\n<table>\n<thead>\n<tr>\n<th>Feature<\/th>\n<th>Consumer<\/th>\n<th>Business<\/th>\n<th>Notes<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Add transfer beneficiary<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Emit a single Transfer<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Emit several grouped transfers<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Emit an instant transfer<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td>Limited to other Sogexia accounts for now<\/td>\n<\/tr>\n<tr>\n<td>Transfers history<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>View Personal IBAN<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Require a secondary French IBAN<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Debit cards<\/h3>\n<table>\n<thead>\n<tr>\n<th>Feature<\/th>\n<th>Consumer<\/th>\n<th>Business<\/th>\n<th>Notes<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Order a debit card<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td>Two types of card exist<\/td>\n<\/tr>\n<tr>\n<td>Activate a debit card<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Lock\/Unlock a debit card<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Retreive debit card PIN<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Unlock debit card PIN<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td>After several failed physical attempts<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Credit card deposits<\/h3>\n<table>\n<thead>\n<tr>\n<th>Feature<\/th>\n<th>Consumer<\/th>\n<th>Business<\/th>\n<th>Notes<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Register a loading credit card<\/td>\n<td>x<\/td>\n<td><\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Credit card deposit<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td>Consumer accounts must use a previously registered card<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Cash deposits<\/h3>\n<table>\n<thead>\n<tr>\n<th>Feature<\/th>\n<th>Consumer<\/th>\n<th>Business<\/th>\n<th>Notes<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Retreive personal barcode<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Direct Debits<\/h3>\n<table>\n<thead>\n<tr>\n<th>Feature<\/th>\n<th>Consumer<\/th>\n<th>Business<\/th>\n<th>Notes<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Direct Debits list<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Provide B2B mandate<\/td>\n<td><\/td>\n<td>x<\/td>\n<td>Business accounts can use the core SEPA scheme as well as the B2B scheme<\/td>\n<\/tr>\n<tr>\n<td>Revoke core mandate<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Revoke B2B mandate<\/td>\n<td><\/td>\n<td>x<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>Reject Direct Debit<\/td>\n<td>x<\/td>\n<td>x<\/td>\n<td>Business accounts can only reject debits that are part of the core scheme<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Changelog<\/h2>\n<p>2020-07-10 - Added mobile applications to program scope<br \/>\n2023-02-23 - Reward amounts raised<br \/>\n2023-02-23 - New SEPA direct debit feature<br \/>\n2023-02-23 - New cash deposit feature<br \/>\n2023-07-23 - New Grouped Transfers feature<br \/>\n2023-07-23 - New postal address update feature<br \/>\n2023-07-23 - Added tracking features in iOS and Android apps<br \/>\n2023-07-23 - Detailed consumer \/ business accounts features<\/p>","type":"bug-bounty","status":"V","demo":false,"public":true,"bounty":true,"gift":false,"hall_of_fame":true,"hacktivity":false,"report_count_per_scope":false,"report_collaboration_active":true,"pid":null,"secured":false,"triaged":null,"disabled":false,"vdp":false,"reports_count":263,"reports_imported_count":null,"pending_hunter_suggestions_count":0,"bounty_reward_min":100,"bounty_reward_max":2000,"scopes_count":3,"archived":false,"thumbnail":{"name":"8c8dde3d-1eef-45e4-9792-53ec43dad50a","original_name":"sogexia-bb.png","mime_type":"image\/png","size":20045,"url":"https:\/\/cdn-yeswehack.com\/program\/thumbnail\/8c8dde3d-1eef-45e4-9792-53ec43dad50a"},"event":null,"business_unit":{"name":"Sogexia","slug":"sogexia","description":"Sogexia is the first French fintech acting as innovative payment services operator and manages at international scale a wide range of innovative banking solutions: payment accounts, physical and virtual cards, mobile payment and additional services.","currency":"EUR","already_activate_product":true,"logo":{"name":"81580ab2d75047837d21d8aeb698b4f9","original_name":"a46fdcd77adc5613ed1b303435ff5986.png","mime_type":"image\/png","size":2628,"url":"https:\/\/cdn-yeswehack.com\/business-unit\/logo\/81580ab2d75047837d21d8aeb698b4f9"}},"vpn_outbound_ips":null,"id":null,"scopes":[{"scope":"https:\/\/my.sogexia.com","scope_type":"web-application","scope_type_name":"Web application","asset_value":"LOW","report_count":null},{"scope":"https:\/\/play.google.com\/store\/apps\/details?id=io.gonative.android.xjndrq&hl=fr","scope_type":"mobile-application-android","scope_type_name":"Mobile application Android","asset_value":"LOW","report_count":null},{"scope":"itmss:\/\/apps.apple.com\/us\/app\/id1510360750?ign-mscache=1","scope_type":"mobile-application-ios","scope_type_name":"Mobile application IOS","asset_value":"LOW","report_count":null}],"out_of_scope":["all domains not listed in scopes, noteworthy:","www.sogexia.com","support.sogexia.com","www.sogexiaclub.com","Social media accounts"],"qualifying_vulnerability":["Remote code execution","Code injections","Authentication flaws","Authorisation flaws \/ privilege escalation","Cross-Site Request Forgery with real security impact","Cross-Site Scripting","Clickjacking","Unciphered HTTP access and mixed content","Sensitive data exposure","Sensitive Information Exposure Through insecure data storage on mobile device","Leaked information from Mobile (without rooting)"],"non_qualifying_vulnerability":["Already known issues","Anything we can't reproduce","Hypothetical flaw or best practices without exploitable POC and concrete attack scenario","Untechnical attacks (phishing, social engineered or physical assault)","Issues that require physical access to a victim's device","Denial of service attacks","Any third party provider's software vulnerabilities including MasterCard network","Vulnerable version of libraries (for example \u2018jquery\u2019) without demonstrable attack vector","Logout and other instances of low-severity Cross-Site Request Forgery","Already known CSRF vulnerability in transaction category management","User enumeration through registration form","Technical information disclosure","Missing security-related HTTP headers which do not lead directly to a vulnerability","Self XSS unless stored","Password and account recovery policies, such as reset link expiration or password complexity","Email configuration","Exploits that are only possible on Android version 7 and below","Exploits that are only possible on IOS version 10 and below","Exploits that are only possible on a jailbroken device","Lack of code obfuscation","Lack of binary protection \/ jailbreak and root detection \/ anti-debugging controls","Crashing your own application","SSL cypher suites","SSL Pinning"],"disclose_bounty_min_reward":null,"disclose_bounty_average_reward":null,"disclose_bounty_max_reward":null,"reward_grid_default":{"bounty_low":100,"bounty_medium":400,"bounty_high":1000,"bounty_critical":2000},"reward_grid_very_low":{"bounty_low":null,"bounty_medium":null,"bounty_high":null,"bounty_critical":null},"reward_grid_low":{"bounty_low":100,"bounty_medium":400,"bounty_high":1000,"bounty_critical":2000},"reward_grid_medium":{"bounty_low":null,"bounty_medium":null,"bounty_high":null,"bounty_critical":null},"reward_grid_high":{"bounty_low":null,"bounty_medium":null,"bounty_high":null,"bounty_critical":null},"reward_grid_critical":{"bounty_low":null,"bounty_medium":null,"bounty_high":null,"bounty_critical":null},"tags":null,"vpn_active":false,"vpn_ips":null,"account_access":"You can create a customer account online but note we're legally bound to only accept European Economic Area residents.","account_access_html":"<p>You can create a customer account online but note we're legally bound to only accept European Economic Area residents.<\/p>","user_agent":null,"disable_message":null,"stats":{"max_reward":null,"average_reward":null,"average_first_time_response":1,"total_reports":263,"total_reports_last24_hours":0,"total_reports_last7_days":3,"total_reports_current_month":2},"supported_languages":["GB","FR"],"report_import_nb_max":null,"report_import_line_max":null,"banner":{"name":null,"original_name":null,"mime_type":null,"size":null,"url":null},"restricted_ips":null,"has_pending_version":null,"rights":["view"],"attachments":null,"hunter_message_enabled":null,"send_hunter_message_validation_required":null,"max_credential_pool_number":null,"videos_attachments_enabled":true,"sla_enabled":null,"sla_grid":null,"systemic_issue_rule_enabled":false,"systemic_issue_rule_grid":{"level1":100,"level2":100,"level3":null,"level4":null,"level5":null,"level6":null},"leakage_rule_enabled":false,"leakage_rule_grid_in_scope":{"fully_in_scope":null,"partially_in_scope":null,"out_of_scope":null},"leakage_rule_grid_out_of_scope":{"fully_in_scope":null,"partially_in_scope":null,"out_of_scope":null},"ywh_triager_user_agent":null,"report_submission_cost":2,"program_metrics":{"report_count":null,"rewards_total_amount":null,"hunter_members_count":null,"active_hunters_count":null,"launched_agentic_campaigns_count":null,"total_agentic_campaigns_count":null,"reports_in_progress_count":null,"reports_in_progress_high_critical_count":null,"reports_assessed_count":null,"reports_assessed_high_critical_count":null,"reports_accepted_count":null,"reports_accepted_high_critical_count":null,"reports_resolved_count":null,"reports_closed_count":null,"computed_at":"2026-11-05T08:41:27+01:00"},"credit_balance":null,"credit_balance_projected":null,"has_history":true,"last_update_at":"2024-10-09T11:51:09+02:00","last_program_version":null}