Details

BitGo’s Bug Bounty Program allows developers to discover and resolve bugs before the general public is aware of such bugs, preventing incidents of widespread abuse. If you find a security vulnerability on the BitGo API, open source software, libraries, or website please let us know right away. Please review the following information before submitting a report.

Responsible Disclosure Policy

If you give us reasonable time to respond to your report before making any information public and make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you. We would prefer to give you recognition for your efforts, but you can remain anonymous at your discretion.
As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
Follow HackerOne's disclosure guidelines.

Program Info

##Rewards

Hall of Fame: if you send in a qualifying vulnerability, at your discretion BitGo will list your name on our website.
Your name will be submitted with your discretion with any CVEs registered if public disclosure is appropriate.
Your choice of payment at various reward tiers.
Job opportunities! We are frequently hiring talented security researchers with strong communication skills. Finding bugs and communicating them well is a great way to get our attention
BitGo employees, former employees, contractors and consultants (including immediate family members and persons living in the same household) are not eligible to receive bounties or rewards of any kind under the BitGo Bug Bounty program.

Attributes of a Helpful Vulnerability

You’re the first person to responsibly disclose the security vulnerability.
The reported vulnerability could compromise the integrity of user data, circumvent the privacy protections of user data, or enable access to a system within our infrastructure, such as:
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF/XSR)
- Broken Authentication
- Circumvention of our Platform/Privacy permission models
- Remote Code Execution
- Privilege Escalation
- Provisioning Errors
While investigating vulnerabilities, you made every attempt to use a test account instead of a real account.
While investigating vulnerabilities you did not cause any service disruption for BitGo customers. We will still never prosecute you if you adhered to our responsible disclosure policy and caused no damages beyond very short term Denial of Service, however irresponsible testing methods may impact your reward level.
While investigating vulnerabilities, you had no interaction with other accounts without the consent of their owners.

How to Send a Report

If a security vulnerability is found that meets the above qualifications, please submit a report through the HackerOne platform or contact BitGo and HackerOne at [email protected]

What to Send in a Report

Provide detailed steps in your message explaining how to reproduce the security vulnerability. This should include any links you clicked on, pages you visited, URLs, user IDs, etc. Provide clear descriptions of any accounts used in your report and the relationships between them.
If you send an image or a video, please:
- Keep it short by showing only the necessary parts.
- Record at a readable resolution.
- Make sure the language of the video is in English to help us quickly identify the problem.
- If a large amount of text appears in your video, please include a copy of the text in your message as well.
- Please keep the video private by uploading it as an attachment.

Rewards for qualifying bugs range from $100 to $20,000 payable in USD or BitCoin through CurrencyCloud. The following table outlines the usual rewards chosen for the most common classes of bugs:*

Category	Examples	Payout Range
Vulnerabilities giving direct access to BitGo servers:
Remote theft of customer funds	Any remote vulnerability where customer funds are able to be spent without requiring customer (or employee) interaction (phishing, XSS, client-side exploits, etc do not count)	$10,000-$20,000
Remote code execution	Command injection, deserialization bugs, sandbox escapes	$5,000-$20,000
Unrestricted file system or database access	Unsandboxed XXE, SQL injection	$5,000-$15,000
Logic flaw bugs leaking or bypassing significant security controls	Direct object reference, remote user impersonation	$500-$5,000
Vulnerabilities giving access to client or authenticated session of the logged-in victim:
Execute code on the client	Web: Cross-site scripting; Mobile: Native code execution	$1,000-$2,500
Other valid security vulnerabilities	Web: CSRF, Clickjacking; Mobile: Information leak, privilege escalation	$100-$2,500
Vulnerabilities that can cause a denial of service:
Make BitGo services unavailable	Subdomain takeover, unmitigated ways to abuse API, lack of ip throttling	$100-$1,500
* The final amount is always chosen at the discretion of the reward panel. In particular, we may decide to pay higher rewards for unusually clever or severe vulnerabilities; decide to pay lower rewards for vulnerabilities that require unusual user interaction; decide that a single report actually constitutes multiple bugs; or that multiple reports are so closely related that they only warrant a single reward.

Out of scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

Clickjacking on pages with no sensitive actions
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
Attacks requiring MITM or physical access to a user's device.
Previously known vulnerable libraries without a working Proof of Concept.
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
Missing best practices in SSL/TLS configuration.
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
Rate limiting or bruteforce issues on non-authentication endpoints
Missing best practices in Content Security Policy.
Missing HttpOnly or Secure flags on cookies
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
Tabnabbing
Open redirect - unless an additional security impact can be demonstrated
Issues that require unlikely user interaction

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep BitGo and our users safe!

Responsible Disclosure Policy

If you give us reasonable time to respond to your report before making any information public and make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you. We would prefer to give you recognition for your efforts, but you can remain anonymous at your discretion.

As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.

Follow HackerOne's disclosure guidelines.

Program Info

##Rewards

Hall of Fame: if you send in a qualifying vulnerability, at your discretion BitGo will list your name on our website.

Your name will be submitted with your discretion with any CVEs registered if public disclosure is appropriate.

Your choice of payment at various reward tiers.

Job opportunities! We are frequently hiring talented security researchers with strong communication skills. Finding bugs and communicating them well is a great way to get our attention

BitGo employees, former employees, contractors and consultants (including immediate family members and persons living in the same household) are not eligible to receive bounties or rewards of any kind under the BitGo Bug Bounty program.

Attributes of a Helpful Vulnerability

You’re the first person to responsibly disclose the security vulnerability.

The reported vulnerability could compromise the integrity of user data, circumvent the privacy protections of user data, or enable access to a system within our infrastructure, such as:

Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF/XSR)
Broken Authentication
Circumvention of our Platform/Privacy permission models
Remote Code Execution
Privilege Escalation
Provisioning Errors

While investigating vulnerabilities, you made every attempt to use a test account instead of a real account.

While investigating vulnerabilities you did not cause any service disruption for BitGo customers. We will still never prosecute you if you adhered to our responsible disclosure policy and caused no damages beyond very short term Denial of Service, however irresponsible testing methods may impact your reward level.

While investigating vulnerabilities, you had no interaction with other accounts without the consent of their owners.

What to Send in a Report

Provide detailed steps in your message explaining how to reproduce the security vulnerability. This should include any links you clicked on, pages you visited, URLs, user IDs, etc. Provide clear descriptions of any accounts used in your report and the relationships between them.

If you send an image or a video, please:

Keep it short by showing only the necessary parts.
Record at a readable resolution.
Make sure the language of the video is in English to help us quickly identify the problem.
If a large amount of text appears in your video, please include a copy of the text in your message as well.
Please keep the video private by uploading it as an attachment.

Rewards for qualifying bugs range from $100 to $20,000 payable in USD or BitCoin through CurrencyCloud. The following table outlines the usual rewards chosen for the most common classes of bugs:*

Category	Examples	Payout Range
Vulnerabilities giving direct access to BitGo servers:
Remote theft of customer funds	Any remote vulnerability where customer funds are able to be spent without requiring customer (or employee) interaction (phishing, XSS, client-side exploits, etc do not count)	$10,000-$20,000
Remote code execution	Command injection, deserialization bugs, sandbox escapes	$5,000-$20,000
Unrestricted file system or database access	Unsandboxed XXE, SQL injection	$5,000-$15,000
Logic flaw bugs leaking or bypassing significant security controls	Direct object reference, remote user impersonation	$500-$5,000
Vulnerabilities giving access to client or authenticated session of the logged-in victim:
Execute code on the client	Web: Cross-site scripting; Mobile: Native code execution	$1,000-$2,500
Other valid security vulnerabilities	Web: CSRF, Clickjacking; Mobile: Information leak, privilege escalation	$100-$2,500
Vulnerabilities that can cause a denial of service:
Make BitGo services unavailable	Subdomain takeover, unmitigated ways to abuse API, lack of ip throttling	$100-$1,500
* The final amount is always chosen at the discretion of the reward panel. In particular, we may decide to pay higher rewards for unusually clever or severe vulnerabilities; decide to pay lower rewards for vulnerabilities that require unusual user interaction; decide that a single report actually constitutes multiple bugs; or that multiple reports are so closely related that they only warrant a single reward.

Out of scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

Clickjacking on pages with no sensitive actions

Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions

Attacks requiring MITM or physical access to a user's device.

Previously known vulnerable libraries without a working Proof of Concept.

Comma Separated Values (CSV) injection without demonstrating a vulnerability.

Missing best practices in SSL/TLS configuration.

Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS

Rate limiting or bruteforce issues on non-authentication endpoints

Missing best practices in Content Security Policy.

Missing HttpOnly or Secure flags on cookies

Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)

Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]

Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).

Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.

Tabnabbing

Open redirect - unless an additional security impact can be demonstrated

Issues that require unlikely user interaction

Safe Harbor

Thank you for helping keep BitGo and our users safe!