BitGo’s Bug Bounty Program allows developers to discover and resolve bugs before the general public is aware of such bugs, preventing incidents of widespread abuse. If you find a security vulnerability on the BitGo API, open source software, libraries, or website please let us know right away. Please review the following information before submitting a report.
Responsible Disclosure Policy
- If you give us reasonable time to respond to your report before making any information public and make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you. We would prefer to give you recognition for your efforts, but you can remain anonymous at your discretion.
- As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- Follow HackerOne's disclosure guidelines.
Program Info
##Rewards
- Hall of Fame: if you send in a qualifying vulnerability, at your discretion BitGo will list your name on our website.
- Your name will be submitted with your discretion with any CVEs registered if public disclosure is appropriate.
- Your choice of payment at various reward tiers.
- Job opportunities! We are frequently hiring talented security researchers with strong communication skills. Finding bugs and communicating them well is a great way to get our attention
- BitGo employees, former employees, contractors and consultants (including immediate family members and persons living in the same household) are not eligible to receive bounties or rewards of any kind under the BitGo Bug Bounty program.
Attributes of a Helpful Vulnerability
- You’re the first person to responsibly disclose the security vulnerability.
- The reported vulnerability could compromise the integrity of user data, circumvent the privacy protections of user data, or enable access to a system within our infrastructure, such as:
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF/XSR)
- Broken Authentication
- Circumvention of our Platform/Privacy permission models
- Remote Code Execution
- Privilege Escalation
- Provisioning Errors
- While investigating vulnerabilities, you made every attempt to use a test account instead of a real account.
- While investigating vulnerabilities you did not cause any service disruption for BitGo customers. We will still never prosecute you if you adhered to our responsible disclosure policy and caused no damages beyond very short term Denial of Service, however irresponsible testing methods may impact your reward level.
- While investigating vulnerabilities, you had no interaction with other accounts without the consent of their owners.
How to Send a Report
- If a security vulnerability is found that meets the above qualifications, please submit a report through the HackerOne platform or contact BitGo and HackerOne at [email protected]
What to Send in a Report
- Provide detailed steps in your message explaining how to reproduce the security vulnerability. This should include any links you clicked on, pages you visited, URLs, user IDs, etc. Provide clear descriptions of any accounts used in your report and the relationships between them.
- If you send an image or a video, please:
- Keep it short by showing only the necessary parts.
- Record at a readable resolution.
- Make sure the language of the video is in English to help us quickly identify the problem.
- If a large amount of text appears in your video, please include a copy of the text in your message as well.
- Please keep the video private by uploading it as an attachment.
Rewards for qualifying bugs range from $100 to $20,000 payable in USD or BitCoin through CurrencyCloud. The following table outlines the usual rewards chosen for the most common classes of bugs:*
| Category | Examples | Payout Range |
|---|
| Vulnerabilities giving direct access to BitGo servers: | | |
| Remote theft of customer funds | Any remote vulnerability where customer funds are able to be spent without requiring customer (or employee) interaction (phishing, XSS, client-side exploits, etc do not count) | $10,000-$20,000 |
| Remote code execution | Command injection, deserialization bugs, sandbox escapes | $5,000-$20,000 |
| Unrestricted file system or database access | Unsandboxed XXE, SQL injection | $5,000-$15,000 |
| Logic flaw bugs leaking or bypassing significant security controls | Direct object reference, remote user impersonation | $500-$5,000 |
| Vulnerabilities giving access to client or authenticated session of the logged-in victim: | | |
| Execute code on the client | Web: Cross-site scripting; Mobile: Native code execution | $1,000-$2,500 |
| Other valid security vulnerabilities | Web: CSRF, Clickjacking; Mobile: Information leak, privilege escalation | $100-$2,500 |
| Vulnerabilities that can cause a denial of service: | | |
| Make BitGo services unavailable | Subdomain takeover, unmitigated ways to abuse API, lack of ip throttling | $100-$1,500 |
| * The final amount is always chosen at the discretion of the reward panel. In particular, we may decide to pay higher rewards for unusually clever or severe vulnerabilities; decide to pay lower rewards for vulnerabilities that require unusual user interaction; decide that a single report actually constitutes multiple bugs; or that multiple reports are so closely related that they only warrant a single reward. | | |
Out of scope vulnerabilities
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
- Clickjacking on pages with no sensitive actions
- Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
- Attacks requiring MITM or physical access to a user's device.
- Previously known vulnerable libraries without a working Proof of Concept.
- Comma Separated Values (CSV) injection without demonstrating a vulnerability.
- Missing best practices in SSL/TLS configuration.
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Rate limiting or bruteforce issues on non-authentication endpoints
- Missing best practices in Content Security Policy.
- Missing HttpOnly or Secure flags on cookies
- Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
- Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
- Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
- Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
- Tabnabbing
- Open redirect - unless an additional security impact can be demonstrated
- Issues that require unlikely user interaction
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep BitGo and our users safe!
