At Dukaan, Security is our Top Priority!
If you are a bug hunter, security researcher, or a white hat hacker, Dukaan is extending you an opportunity to show your skills in identifying security vulnerabilities and get rewarded/recognized in return.
If you discover a vulnerability, we appreciate your cooperation in responsibly reporting it to us so that we can address it as soon as possible.
We try our best to keep all platforms of Dukaan secure, and make every effort to keep on top of the latest threats by working with our inhouse security team and external security consultants. If you are able to spot any security issues or vulnerabilities, please report here.
We would like to continuously build relationships and work with as many security technology enthusiasts as possible, and fairly reward any such issues spotted as well.
Program Rules
- Don't violate the privacy of other users, destroy data, disrupt our services, etc.
- Give us a reasonable time to respond to the issue so that our team will try to triage all reports with priority to the severity, scenario and exploit complexity. We will notify you when the reported vulnerability is remediated, and you may confirm that the solution covers the vulnerability adequately.
- Only target your own accounts in the process of investigating any bugs/findings. Don't target, attempt to access, or otherwise disrupt the accounts of other users without the express permission of our team.
- Don't target our physical security measures, or attempt to use social engineering, spam, distributed denial of service (DDOS) attacks, etc.
- In case you find a severe vulnerability that allows system access, you must not proceed further.
- It is Dukaan's decision to determine when and how bugs should be addressed and fixed.
- Disclosing bugs to a party other than Dukaan is forbidden, all bug reports are to remain at the reporter and Dukaan's discretion.
- Threatening of any kind will automatically disqualify you from participating in the program.
- Exploiting or misusing the vulnerability for your own or others' benefit will automatically disqualify the report.
- Bug disclosure communications with Dukaan's Security Team are to remain confidential. Researchers must destroy all artifacts created to document vulnerabilities (POC code, videos, screenshots) after the bug report is closed.
Eligibility
- Be the first to report the issue to us.
- Must pertain to an item explicitly listed under Vulnerability Categories.
- Must contain sufficient information including a proof of concept screenshot, video, or code snippet where needed.
- You agree to participate in testing the effectiveness of the countermeasure applied to your report.
- You agree to keep any communication with Dukaan private.
Vulnerability Categories
Vulnerability Types
- Cross-Site Request Forgery
- Cross-Site Scripting
- Open Redirects
- Cross Origin Resource Sharing
- SQL Injections
- Server Side Request Forgery
- Privilege Escalation
- Local File Inclusion
- Remote File Inclusion
- Leakage of Sensitive Data
- Authentication Bypass
- Directory Traversal
- Payment Manipulation
- Remote Code Execution
- Information Disclosure
- Subdomain Takeover
- Insecure Direct Object Reference (IDOR)
Exclusions
- Missing any best security practice that is not a vulnerability
- Self XSS
- Username or email address enumeration
- Email bombing
- HTML injection
- XSS vulnerabilities on sandbox aka user-content domains
- Unvalidated aka Open redirects or Tabnabbing
- Clickjacking in unauthenticated pages or in pages with no significant state-changing action
- Logout or unauthenticated CSRF
- Missing cookie flags on non-sensitive cookies
- Missing security headers that do not lead directly to a vulnerability
- Unvalidated findings from automated tools or scans
- "Back" button that keeps working after logout
- Attacks that require physical access to a user device
- Social engineering
- Use of a known-vulnerable library (without evidence of exploitability)
- Low-impact descriptive error pages and information disclosures without any sensitive information
- Invalid or missing SPF/DKIM/DMARC/BIMI records
- Password and account policies, such as (but not limited to) reset link expiration or password complexity
- Phishing risk via unicode/punycode or RTLO issues
- Missing rate limitations on endpoints (without any security concerns)
- Presence of EXIF information in file uploads
- Ability to upload/download executables
Scope
Got Questions? We Got Answers!
If you have a query or complaint about the Dukaan Bug Bounty Program, please contact us using [email protected] email address.
