
Magic
External Program
Submit bugs directly to this organization
###Magic
Magic is a developer SDK that empowers applications with passwordless authentication using magic links, WebAuthn, OAuth, and other authentication tools.
Magic also builds a robust and distributed key management solution that supports this authentication infrastructure.
When users want to sign up or log in to an application, the typical flow is:
Magic also supports and builds Fortmatic, a cryptocurrency wallet integrated with many leading blockchain companies around the world.
As part of Magic's mission and security overview, we want to improve the developer experience of authentication, while keeping security top of mind for all developers. We recognize the importance of maintaining security in our services in order to keep our users safe.
With this bounty program, we encourage researchers to discover security vulnerabilities in our systems. These can cover almost any aspect of the product, from SDKs, APIs, public-facing codebases, user interfaces, developer dashboards, and more.
Both Magic and Fortmatic's products and services are under scope for testing.
We’d like to highlight the following focus areas for this Bug Bounty Program:
Magic will make a best effort to meet the following response targets for researchers participating in our program:
We will try to keep you informed about our progress throughout the process.
Complying with the Bug Bounty Program policy requires researchers to adhere to our requirements detailed below.
###Reporting Requirements
###Disclosure Requirements
###Research Requirements
Failure to comply with the Bug Bounty Program or any of the requirements or policies leads to automatic ineligibility for payouts.
##In Scope Vulnerabilities
For this bug bounty program, all software vulnerabilities are considered in scope unless specified below. Please refer to the structured scopes section to find our in-scope assets.
##Out of Scope Vulnerabilities
##Out of Scope Assets
#How To Get Started Researchers will require the following to be able to conduct research:
###Create Your Test Account
The best way to get started with the program is to navigate to our Magic developer dashboard or Fortmatic developer dashboard and sign-up for a developer account. This will give you access to API keys which can be used to access our assets as well as a comprehensive set of docs to get started. Furthermore, as the dashboard is an in-scope asset, you may just find inspiration for a vulnerability while signing up and familiarizing yourself with its features.
###Create Your dApp Please visit our Magic documentation or Fortmatic documentation to get you set up with our products (you'll be up and running in <5 minutes).
To encourage responsible disclosures, we will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy. We consider security research and vulnerability disclosure activities conducted consistent with this policy to constitute “authorized” conduct under the Computer Fraud and Abuse Act, the DMCA and applicable anti-hacking laws such as Cal. Penal Code 502(c). We waive any DMCA claim against you for circumventing the technological measures we have used to protect the applications in scope. If legal action is initiated by a third party against you and you have complied with this bug bounty policy, we will take steps to make it known that your actions were conducted in compliance with this policy. Please understand that if your security research involves the networks, systems, information, applications, products, or services of another party (which is not us), that third party may determine whether to pursue legal action. We cannot and do not authorize security research in the name of other entities. You are expected, as always, to comply with all applicable laws. Please submit a report to us before engaging in conduct that may be inconsistent with or unaddressed by this policy.
This document contains material from the #legalbugbounty project, which can be found on github.
The collection of information in Magic's product is bound by the terms described in our Privacy Policy