Swiggy Bug Bounty
What is Security Bug Bounty Responsible Disclosure Program?
We work hard to keep Swiggy secure, and make every effort to keep on top of the latest threats by working with our inhouse security team. If you think we've made a security mistake or have a vulnerability, please share with us right away.
How to report a bug
If you're the first one to alert us and it leads to us making a change, we'll pay you a reward based on the criticality.
To participate in the Swiggy Bug Bounty Program, you can Sign Up using your phone number and email ID from the website home page or app. Do ensure that you are reachable on the mobile number that you shall use to register with us. While creating account, participants should use this particular email ID format as below: [email protected]
Participants to the Program shall strictly be bound by Swiggy Non-Disclosure Terms.
Responsible Disclosure
The identified bug shall have to be reported to our security team by sending us a mail from your registered email address to [email protected] with email containing below details with subject prefix with "Bug Bounty". The mail should strictly follow the format below.
Subject:
Bug Bounty: -
Email body:
Vulnerability Information:
- Name of Vulnerability:
- Vulnerability Category:
- Description:
- Vulnerable Instances:
- Steps to Reproduce:
- Proof of Concept:
- Impact:
- Recommendation:
Bounty Hunter details:
- Full Name:
- Email Address:
- Mobile Number:
- Any Publicly Identifiable profile:
Note: For in subject line, please try to select vulnerability category closely matched with defined in Reward categorisations. The Swiggy security team will review the submission and revert back within 5 working days.
Program scope
In-Scope Targets
Out-of-Scope
- Vendor Endpoints
- Delivery App Endpoints
- 3rd Party Applications
Reward Categorisation
Note: Automated tools or scripts ARE STRICTLY PROHIBITED, and any POC submitted to us should have a proper step-by-step guide to reproduce the issue.
Abuse of any vulnerability found shall be liable for legal penalties.
Note: Bounty rewards will be established after discussion with the stakeholder leadership team.
All the bounty rewards will be paid based on an internal assessment by the Swiggy security team. We have grouped vulnerabilities based on impact in below severity categorisation. Vulnerability categorisation based on severity created to give insight how we assess the vulnerabilities. It's not an exhaustive list and Swiggy can update it at any point of time.
Critical
- SQL Injections (Able to access and manipulate sensitive and PII information)
- Remote Code Execution (RCE) vulnerabilities
- Shell Upload vulnerabilities (Only upload basic backend script that just prints some string, preferably try printing the hostname of the server and stop there!)
- Vertical privilege escalation (Gaining admin access)
- Bulk user sensitive information leak
- Business logic vulnerabilities (Critically impacting Swiggy Brand, User (Customer/Vendor/Delivery Executive) data and financial transactions)
High
- Authentication bypass
- Non-Blind SSRFs
- Account Takeover (Without user interaction)
- Stored XSSs
- Subdomain Takeover (On active domains)
- IDOR (Able to access and modify sensitive and PII information)
- Horizontal privilege escalations
- Deserialization vulnerabilities
- Path traversal (Access to sensitive information)
- Mobile App vulnerability (Doesn't require root/jailbreak access on the device and having access to sensitive information)
Medium
- SQL Injection (For non-sensitive information)
- Account Takeover (With user interaction)
- IDOR (Able to access and modify non-sensitive information)
- Reflected/DOM XSS to steal user cookies
- Subdomain Takeover (On non-active domains)
- Injection attacks (Formula injection, Host header injection)
- Mobile App vulnerability (Require root/jailbreak access on the device and having access to sensitive information)
Low
- Path Traversal (Access non-sensitive information)
- IDOR (Non-sensitive information disclosure)
- Mobile App vulnerability (Require root/jailbreak access on the device and having access to non-sensitive information)
- Mobile App vulnerability (Doesn't require root/jailbreak access on the device and having access to non-sensitive information)
- Captcha bypass
Exclusions
General
- IDOR references for objects that you have permission to
- Duplicate submissions that are being remediated
- Known issues
- Rate limiting (Unless which impacts severe threat to data, business loss)
- Multiple reports for the same vulnerability type with minor differences (only one will be rewarded)
- Open redirects
- Clickjacking and issues only exploitable through clickjacking
- Only session cookies needed http and secure flags. Apart from these, for other cookies we won't consider as vulnerability
- Social Engineering attacks
System related
- Patches released within the last 30 days
- Networking issues or industry standards
- Password complexity
Email related
- SPF or DMARC records
- Gmail "+" and "." acceptance
- Email bombs
- Unsubscribing from marketing emails
Information Leakage
- Descriptive error messages (e.g. Stack Traces, application or server errors)
- HTTP 404 codes/pages or other HTTP non-200 codes/pages
- Fingerprinting / banner disclosure on common/public services
- Disclosure of known public files or directories, (e.g. robots.txt)
- Cacheable SSL pages
- SSL/TLS best practices
CSRF
- CSRF on forms that are available to anonymous users (e.g. the contact form, sign-up form)
- Logout Cross-Site Request Forgery (logout CSRF)
- Weak CSRF in the APIs
Login/Session related
- Forgot Password page brute force and account lockout not enforced
- Lack of Captcha
- Sessions not expiring after email change
- Presence of application or web browser 'autocomplete' or 'save password' functionality
- Session Timeouts
Swiggy Non-Disclosure Terms ("Terms")
Definition
'Confidential information' shall mean all information supplied in confidence by the Company to the Participant, which may be disclosed to the Participant or otherwise acquired by the Participant in its performance under this Security Bug Bounty Responsible Disclosure Program including:
- All information which a reasonable person would consider confidential under the context of disclosure or due to the nature of the information itself, and shall include technical and non-technical information, intellectual property rights, know-how, designs, techniques, plans, procedure, improvement, technology or method, object code, source code, databases or any other information relating to the Company's product, work in progress, future development of the Company's product
- Marketing strategies, plans, financial information, projections, operations, sales estimates, shareholding patterns, business plans and performance results relating to the past, present or future business of the Company, plans for products or services, and customer or supplier lists
- The content, the technical documents and all information in relation to the Company's product the terms of this Agreement
- Any information which may be communicated.
Obligation of Confidentiality
The Participant undertakes to treat and maintain all Confidential Information in confidence. With respect thereto, the Participant undertakes and agrees as follows:
- These Terms do not create a joint venture or partnership between the Parties.
- For a period of 5 (five) years the Participant shall not publish, disseminate, disclose any Confidential Information.
- The Participant shall use the Confidential Information only in connection with the Purpose and for no other reason whatsoever
- The Participant shall not copy or reproduce to writing any part of the Confidential Information and any copies, reproductions or reductions to writing of the Confidential Information which have already been made by the Parties shall be the property of the Company.
- The Participant shall not, from the date of agreeing to these Terms, independently develop or have developed for itself products, concepts, systems or techniques that are similar to or compete with the products, concepts, systems or techniques contemplated by or embodied in the Confidential Information of the Company or the Purpose, which development shall be construed as a violation of the obligations of the Participant under these Terms.
- The Participant shall indemnify, defend and hold the Company harmless from and against any losses, costs, expenses, damages of whatsoever nature which may be incurred or suffered by the Company arising out of or as a result of any breach of contract, warranty, tort (including negligence) or otherwise of any of the Participant's obligations or agreements contained herein.
Ownership
All Confidential Information furnished to the Participant by the Company shall remain the exclusive property of the Company and the Company shall have the sole and exclusive ownership of all right, title, and interest in and to the Confidential Information, including ownership of all copyrights, patents and trade secrets pertaining thereto, subject only to the rights and privileges expressly granted by the Company under the Terms mentioned here in above.
Promptly upon the Company's request at any time, the Participant shall return / cause to be returned to the Company all the Confidential Information, including all materials or documents, any copies, summaries and notes of the contents thereof (whether in hard or soft copy form) without limitation, all copies of any analyses, compilations, studies or other documents prepared by and/or for Company, containing or reflecting any Confidential Information and give written certification accordingly.
Remedies
The Participant understands and acknowledges that any disclosure or misappropriation of any of the Confidential Information in violation of the confidentiality obligations will cause the Company grave and irreparable harm, loss and injury, the amount of which may be difficult to ascertain. The Participant agrees that the Company have the right to apply to a court of competent jurisdiction for specific performance and/ or an order restraining and enjoining any such further disclosure or breach and for such other relief as the Company shall deem appropriate, without posting or the need to post any bond or other security. Such right of the Company to obtain equitable relief in the form of specific performance, temporary restraining order, temporary or permanent injunction or any other equitable remedy which may then be available to it, without the necessity of proving actual damages, shall be in addition to the remedies otherwise available to it at law. The Participant expressly waives the defense that a remedy in damages will be adequate.
No Warranties
Nothing contained in the Terms mentioned hereinabove shall be construed to obligate the Company to disclose any information to the Participant.
Miscellaneous
- Any notice or communication to be given under to the Participant shall be given if delivered in writing to the intended Participant on the email id provided by the Participant at the time of registration
- These Terms shall be fully binding upon the Participant.
- The Participant shall not make any assignment of these Terms or any interest therein.
- The failure of the Company to insist upon or enforce strict performance of any of the Terms mentioned hereinabove or to exercise any rights or remedies mentioned hereinabove, shall not be construed as a waiver or relinquishment to any extent of the Company's rights to assert or rely upon any such provisions, rights or remedies in that or any other instance; rather the same shall remain in full force and effect.
- These Terms shall be governed by, construed and enforced in accordance with the laws of the Republic of India.
- The courts in Bangalore shall have the exclusive jurisdiction
