BDO Switzerland
Bounty Range
$124 - $6,200
external program
BDO Switzerland
Increased Bounties
BDO Ltd is one of the leading audit, business services and advisory firms in Switzerland. We offer services in our core areas of expertise: audit, financial services, business services and outsourcing, tax and legal advisory, and management consulting. With 35 offices in Switzerland, BDO's network offers the most extensive coverage in the industry. For BDO's people – around 1,600 professionals – close links and expertise are the key to successful and lasting relationships with our clients. BDO Ltd audits and advises industrial and service sector companies, including SMEs, listed companies, public authorities and non-profit organisations.
The organisation operates various services (platforms, services). But only services from explicitly listed domains / URLs are in the scope of the program. All other domains or explicitly listed services are therefore not eligible for reward and do not fall under the Legal Safe Harbor Agreement.
By participating in this program, security researchers undertake to document information about any vulnerability found exclusively via the platform's designated reporting form and not in any other places. They also agree to keep the found vulnerability secret after reporting it on the platform. Finally, they undertake to upload to the platform any data from customers that they have obtained as part of the test and to delete any local copies afterwards and not to distribute them further.
In participating in the program, security researchers agree not to use methods that would adversely affect the tested applications or their users. These include:
In addition to the prohibited hacking methods listed above, security researchers are required to immediately discontinue vulnerability scanning if they determine that their conduct will result in a significant degradation (negative impact on regular users or on the operations team) of the Platform's or Service's operations.
Any design or implementation problem can be reported that is reproducible and affects security.
Typical examples:
Other examples:
The following vulnerabilities and forms of documentation are generally not wanted and will be rejected:
In scope:
The organisation gives their approval for security researchers to use hacking methods based on the specified briefing. Due to this consent, the criminal liability criterion of unauthorized obtaining/unauthorized use and thus the criminal liability of the security researchers with regard to the criminal offenses in Art. 143 Swiss Criminal Code (Unauthorised obtaining of data) and Art. 143bis Swiss Criminal Code (Unauthorised access to a data processing system) does not apply.
| Severity | Bounty |
|---|---|
| Critical | CHF 2000-5000 |
| High | CHF 800-2000 |
| Medium | CHF 300-800 |
| Low | CHF 100-300 |