#Summary Zelle® is transforming how money moves, with more than five billion digital payments sent since its launch in 2017. The Zelle Network® connects more than 2,100 bank and credit union brands of all sizes, enabling consumers and businesses to send digital payments to people and businesses they know and trust with an eligible bank account in the U.S. Money is available directly in bank accounts generally within minutes when the recipient is already enrolled with Zelle®.

Zelle® and Paze ℠ are the property of Early Warning Services, LLC.

This program is for the Zellepay.com website, the Zellepay Partner Portal, the Zellepay Customer Portal, the Zellepay iOS and Android mobile apps, and the supporting Web service APIs.

In this program we will reward for vulnerabilities that are found in the business logic or the application platform stack.

#Testing Credentials Early Warning does not maintain official testing accounts to be provisioned to security researchers. No credentials will be provided.

#Response Targets Early Warning will make a best effort to meet the following response targets for hackers participating in our program:

• Time to first response (from report submit) - 1 business day
• Time to triage (from report submit) - 2 business days
• Time to bounty (from triage) - 1 business day

We’ll try to keep you informed about our progress throughout the process.

#Disclosure Policy

• Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express written consent from the organization.
• Follow HackerOne's disclosure guidelines.

#Program Rules

• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

#Access and Authentication Required

• The iOS and Android mobile applications are available for download from their respective app stores
• No credentials will be provided
• Reports that cannot demonstrate impact through screenshots and/or video reproduction to the organization will be closed as N/A
• Temporary cards and all other cards will not be accepted
• Your [user]@wearehackerone email alias must be used when conducting testing in the program. Failure to do so may cause your traffic to be treated as an attack, and will be responded to accordingly
• No Early Warning employees may participate in this bug bounty program

#Rewards Please see the structured bounty table. Our bounty table provides general guidelines, and all final decisions are at the discretion of Early Warning.

Reports that include a Nuclei Template to validate the submitted vulnerability may be awarded a bonus of between $100-$200. The Nuclei Template must be unique for the submitted vulnerability and existing open-source community templates will not be eligible for a bonus. Nuclei Template bonuses will be given out at the sole discretion of Early Warning.

Early Warning retains a perpetual right to complete ownership and usage of the submitted Nuclei Template. Researchers are prohibited from making submitted templates available to the public without express written consent from Early Warning.

#Requested Focus Areas

• Unauthorized access to card data
• Business logic flaws allowing the unauthorized transfer of funds
• Authentication bypass
• Remote code execution
• Unauthorized access to customer data
• Unauthorized access to the zellepay.com website
• Unauthorized access to the zellepay.com Partner Portal
• Cross-site scripting (XSS)
• SQL injection (SQLi)
• Cross-site request forgery (CSRF) for critical functions such as money transfers or money requests

#Out of scope vulnerabilities When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

##Out of scope

• Reports from automated tools or scans
• Zelle® functionality in any bank app
• Denial of service attacks in any form or fashion
  • If you suspect a non-volume-based denial-of-service bug exists, create a bug bounty report before testing and Early Warning Services team will evaluate each report on a case-by-case basis
• Volume-based attacks, including lack or tuning or rate-limiting
• Spoofing text messages that appear to come from zellepay, if it does not result in an actual transfer of money
• Social Engineering
• Email spoofing (eg Lack of SPF, DKIM, DMARC records)
• Attacks that involve emailing or texting any user, if it does not result in an actual transfer of money
• Descriptive error messages (e.g. Stack Traces, application or server errors)
• Clickjacking on pages with no sensitive actions
• Unauthenticated/logout/login CSRF
• Previously known vulnerable libraries without a working Proof of Concept
• Comma Separated Values (CSV) injection without demonstrating a vulnerability
• Missing best practices related to:
  • SSL/TLS
  • Security headers without direct exploitability 
  • SPF, DKIM, DMARC
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
• Any domains that resolve to Salesforce endpoints within scope must be tested in accordance with Salesforce's Security Assessment Policy
• The decommissioned Android and iOS applications are no longer in scope
• Please note the Zellepay Facebook page (https://www.facebook.com/zellepay) is region-locked to only display for US customers. Anyone outside the US will see the error: "The link you followed may have expired, or the page may only be visible to an audience you're not in. " This is by design, and any reports of this as a bug will be closed.
• Credential dumps
  • Customer credentials: As we cannot control how customers manage or secure their credentials on their systems, we do not pay bounties for customer credential dumps originating from third party sites.
  • Employee credentials: We have an internal team that monitors the web for employee credential dumps. Any reports received will be forwarded to them, and if they are already aware of the reported credential dump, the report will be closed as 'informational'.

Starting Domains

Here is a list of sub-domains that you can use to get started:

• accountinfo-cat.earlywarning.com
• accountinfo.earlywarning.com
• identitychek.earlywarning.com
• identitychekcat.earlywarning.com
• mfa.earlywarning.com
• identitychekcatxml.earlywarning.com
• identitychekxml.earlywarning.com
• sa*.earlywarning.com
• partners.zellepay.com
• register.zellepay.com

Please note that not all sub-domains may resolve.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Early Warning and our users safe!