Program Description

The security of its vehicles, digital services and accessories is important to Porsche. We therefore prioritize the confidentiality, integrity and availability of our data and systems. Porsche extends this commitment to encompass customers, employees and partners as well. Despite careful development, manufacturing and testing, vulnerabilities may exist in individual cases. We value the work of security researchers in improving the security of our products and digital services and appreciate it when the community reports vulnerabilities that affect our assets. Our commitment lies in collaborating with highly skilled researchers to validate, reproduce and respond to legitimately reported vulnerabilities that are covered by the given initiative’s rules and policies. With the given bug bounty rewards can be received by reporting vulnerabilities that are in scope of the program. Please take note of the program scope outlined in the scope tab of our policy. Testing any out-of-scope assets is strictly prohibited and will not be tolerated under any circumstances. Any such actions may lead to immediate disqualification from the program and further consequences. Only vulnerabilities discovered within the scope of the Safe Harbor Agreement qualify for submission and bounty consideration.

Exclusion of Porsche employees and active contractors/suppliers

We're excited to continue our commitment to enhancing security through the given bug bounty program. To ensure fairness and transparency, we want to clarify that our valued employees, contractors and suppliers with active procurement orders are not eligible to participate in the program. Additionally, you should not use duplicate HackerOne accounts. Thank you for your understanding and ongoing support in making our systems safer for everyone.

Response Times

Generally, we try to achieve the following response times:

Disclosure Policy

• Do not disclose details of this program or vulnerabilities (even resolved ones) to the public or any third party without Porsche AG’s explicit consent.
• Follow Porsche´s standard disclosure policy.
• Follow HackerOne's disclosure guidelines.

General Rules

• In case of duplicate submissions, only the first report that was received will be awarded (provided that it can be fully reproduced).
• Multiple exploits caused by one underlying vulnerability will be awarded one bounty.
• Some sites might rely on shared resources or assets. If we identify this issue, we will only award a bounty for the first report.
• Public Zero-day vulnerabilities that have had an official patch for less than 6 weeks will be awarded on a case-by-case basis.
• Only interact with accounts you own or with the explicit permission of the account holder.
• Vulnerabilities that are reported on identical systems in different hosted environments (development, production, test) are counted as one vulnerability.
• After successful triage and subsequent closing of a report, security researchers are kindly asked to check the vulnerability for successful remediation.
• Excessive or repeated testing of systems outside the permitted scope may be considered misuse of the service and may result in temporary suspension or permanent termination of the user's account.

Test Plan

• No test accounts and no credentials will be provided for this program. However, if any application that is found allows for account creation / self-registration that would be considered in scope. In this case, please use your @wearehackerone.com e-mail address.
• Researchers should add headers to requests such as: “X-HackerOne-Research: [H1 username]”

Do´s

• Always submit proof or a PoC regarding the exploitability for your finding.
• Provide detailed reports with reproducible steps, including the full http requests leading to the exploit.
• Submit one vulnerability per report, unless you need to chain the vulnerabilities for successful exploitation.
• Please, only ever target your own account or a test account.

Dont´s

• Do not use automated vulnerability scanners on this program. However, targeted use of scanners for specific functionalities, custom scripts & fuzzing tools are permitted. If using any of these tools, please keep your traffic to six requests per second or less in order not to cause any degradation to Porsche’s services.
  Note that we already run automated scans against the in-scope targets – so using these tools is likely of minimal utility to researchers.
• Do not access or make changes to customer accounts.
• Do not perform social engineering attacks, including phishing.
• Do not spam.
• Do not engage in any activity that bombards Porsche services with substantial amounts of requests or large volumes of data.
• Do not perform any physical attacks or engage in any activity in the physical domain that would cause damage or harm to any property or persons.
• Do not impact the privacy of third parties.
• Do not harm anyone.
• Any lateral movement and post-exploitation past the initial exploitation is forbidden.

Scope

For submissions on assets in scope, please ensure the following requirements are met:

Browsers

Browsers must be up to date (latest released stable version) on the day of submission. Vulnerabilities which require certain plugins are out of scope.

Only the following browsers are in scope:

• Chrome
• Firefox
• Safari
• Edge
• Internet Explorer

#Mobile Applications Overview

The following vulnerabilities and finding types are out of scope:

• Self-XSS and Similar Issues: Vulnerabilities only possible through self-executed cross-site scripting.
• Email Spoofing: Including SPF, DKIM, DMARC From: spoofing and visually similar and related issues.
• CSRF Without Integrity Impact: Cross-site request forgery issues that do not affect account integrity (e.g., login/logout, contact forms, and other publicly accessible forms).
• Lack of Rate Limiting: Issues based on missing rate limiting.
• Denial of Service Attacks: Including distributed denial of service (DDoS) and simulated DoS attacks.
• Request, Port, and Protocol Flooding: Vulnerabilities caused by flooding requests, ports, or protocols.
• Outdated Operating Systems or Browsers: Issues exploitable only on user devices with old versions of operating systems or browsers.
• Unpatched CVEs in Third-Party Products: Recent unpatched common vulnerabilities and exposures (CVEs) in third-party products or libraries.
• CVEs Without Security Impact: CVEs in third-party products or libraries that do not have a security impact.
• Non-Sensitive API Key Leakage: Such as etherscan, Infura, Alchemy.
• Human-Related Vulnerabilities: Including phishing and social engineering.
• Fingerprinting/Banner Disclosure: On common/public services.
• Man-in-the-Middle Attacks: Attacks requiring man-in-the-middle or physical access to a user's device.
• Automated Tools/Scans: Reports from automated tools or scans without proof of a unique, valid security threat.
• Content Spoofing/Text Injection: Without showing an attack vector or the ability to modify HTML/CSS.
• Brute Force Attacks: Issues based on brute force attacks.
• Password and Account Recovery Policies: Such as reset link expiration or password complexity.
• Outdated/Unpatched Browsers and Platforms: Vulnerabilities affecting users of outdated or unpatched browsers and platforms.
• Speculative Reports: Theoretical damage without proof of concept.
• Physical or Social Engineering Attempts: Including phishing attacks against employees.
• Open Ports/Services: Without proof of concept demonstrating a vulnerability.
• Criminal Information Gathering: Vulnerabilities relying on payed or stolen information (e.g. credentials).
• Physical Access to Devices, Products
• Clickjacking: On pages without sensitive actions.

Out of Scope for iOS apps:

• Absence of certificate pinning.
• Lack of jailbreak detection.
• Runtime hacking exploits (exploits only possible in a jailbroken environment).

Out of Scope for Android apps:

• Absence of certificate pinning.

The following vulnerabilities and finding types are currently not eligible for rewards, except if a concrete impact is demonstrated

• Internal IP Address Disclosure: Disclosure of internal IP addresses.
• Theoretical Vulnerabilities and Third-Party Libraries: Vulnerabilities of third-party libraries without showing specific impact (e.g. CVE with no exploit).
• Information Leaks Without Direct Security Impact: Such as detailed server configuration, metrics/health endpoints, debug pages, descriptive error messages, stack traces, application or server errors, path disclosure.
• Weak Captcha Bypass: Using OCR without impact demonstration.
• Reflected Plain Text Injection: Such as URL parameters, path. 1. This does not exclude reflected HTML injection with or without JavaScript. 2. This does not exclude persistent plain text injection.
• Missing Security Best Practices: Such as missing CORS and HTTPS security headers without impact, lack of SSL/TLS best practices, and similar issues.
• Username/Email Enumeration: 1. Via login page error message. 2. Via forgot password error message.
• Forgot Password Page Brute Force and Account Lockout Not Enforced: Issues related to brute force attacks on the forgot password page and lack of account lockout enforcement.
• HTTPS Mixed Content Scripts: Issues related to mixed content scripts over HTTPS.

Safe Harbor

Any activities of a researcher in compliance with this Bug Bounty program and policy on in-scope assets will be considered as authorized by Porsche and we will not take any legal action against the researcher. If third parties initiate legal actions against the researcher based on those activities, the researcher may reference this Bug Bounty program and policy. We explicitly reject criminal activity in any form. Additionally, the following safe harbor guidelines apply:

• We utilize code written, products produced and services provided by third parties. They belong to their respective owners. We can’t grant you permission to reverse engineer any of that code or access any of that data.
• Comply with all applicable laws, regulations and other statutory provisions.
• Participation in this program is not permitted for persons on sanctions lists.
• We promise not to initiate any criminal proceedings against you as long as you have adhered to the policy and principles. However, this does not apply if there have been or are discernible criminal intentions.
• If applicable, you are expected to comply with the AWS and Azure policies & rules of engagement for penetration testing:
  1. Penetration Testing - Amazon Web Services (AWS) 2. Microsoft Cloud Penetration Testing Rules of Engagement

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via HackerOnes´s approved communication channels before going any further.

Thank you for helping keep Porsche and our users safe!