{"title":"Superbank - Public Bug Bounty Program","slug":"superbank-public-bug-bounty-program","rules":"## Superbank\n\nSuperbank is a prominent digital banking platform in Indonesia, known for providing innovative, customer-centric banking services powered by advanced technology. It aims to redefine banking experiences by offering seamless, easy-to-use services through mobile and online platforms. For now, Superbank as a digital banking in indonesia is created a bug bounty program with the scope and a program rules below.\n\n## Scopes description\n\n#### Android & iOS\n\nThis app is critical to our business as it's where the user use our mobile banking application.The app allows users to perform a wide range of banking activities directly from their mobile devices, making it a convenient tool for managing finances on the go.\n\n#### API\n\nThis API is critical to our business as it's where the user use our services on our environment. \n\n#### Web Application\n\nThis application is our company profile and our ecosystem webview where user find any information regarding our bussiness and register on our application.\n\n## Program Rules\n\n### Testing Policy, Responsible Disclosure\n\nPlease adhere to the following rules while performing research on this program:\n- Denial of service (DoS) attacks on Superbank applications, servers, networks or infrastructure are strictly forbidden.\n- Avoid tests that could cause degradation or interruption of our services.\n- Do not use automated scanners or tools that generate large amount of network traffic\n- Do not leak, copy, manipulate, or destroy any user data or files in any of our applications\/servers.\n- No vulnerability disclosure, full, partial or otherwise, is allowed.\n\n#### Important precautions and limitations\n\nAs a complement to the Program\u2019s rules and testing policy :\n- DO NOT alter compromised accounts by creating, deleting or modifying any data\n- DO NOT use compromised accounts to search for post-auth vulnerabilities (they won\u2019t be eligible anyway)\n- DO NOT include Personally Identifiable Information (PII) in your report and please REDACT\/OBFUSCATE the PII that is part of your PoC (screenshot, server response, JSON file, etc.) as much as possible.\n- In case of exposed credentials or secrets, limit yourself to verifying the credentials validity\n- In case of sensitivie information leak, DO NOT extract\/copy every document or data that is exposed and limit yourself to describe and list what is exposed. \n\n### Reward Eligibility\n\nWe are happy to thank everyone who submits valid reports which help us improve the security of Superbank, however only those that meet the following eligibility requirements may receive a monetary reward:\n- You must be the first reporter of a vulnerability.\n- The vulnerability must be a qualifying vulnerability\n- The report must contain the following elements:\n - Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and Superbank, and remediation advice on fixing the vulnerability\n - Proof of exploitation: screenshots\/video demonstrating the exploit was performed, and showing the final impact\n - Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc\n- You must not break any of the testing policy rules listed above\n- You must not be a former or current employee of Superbank, Grab, OVO, GxS, GxB or one of its contractors.\n\nReward amounts are based on:\n- Reward grid of the report's scope\n- CVSS scoring and actual business impact of the vulnerability upon performing risk analysis","rules_html":"

Superbank<\/h2>\n

Superbank is a prominent digital banking platform in Indonesia, known for providing innovative, customer-centric banking services powered by advanced technology. It aims to redefine banking experiences by offering seamless, easy-to-use services through mobile and online platforms. For now, Superbank as a digital banking in indonesia is created a bug bounty program with the scope and a program rules below.<\/p>\n

Scopes description<\/h2>\n

Android & iOS<\/h4>\n

This app is critical to our business as it's where the user use our mobile banking application.The app allows users to perform a wide range of banking activities directly from their mobile devices, making it a convenient tool for managing finances on the go.<\/p>\n

API<\/h4>\n

This API is critical to our business as it's where the user use our services on our environment. <\/p>\n

Web Application<\/h4>\n

This application is our company profile and our ecosystem webview where user find any information regarding our bussiness and register on our application.<\/p>\n

Program Rules<\/h2>\n

Testing Policy, Responsible Disclosure<\/h3>\n

Please adhere to the following rules while performing research on this program:<\/p>\n