Bug bounty program

Summary

Disclaimer:

This Summary is intended for informational purposes only and is not binding. Participation requires Your review and acceptance of the Bug Bounty Policy itself.
Nothing in this Summary shall be construed as binding on any Party or limiting the Policy in any way.

PayDo Bug Bounty Programme offers rewards to security researchers who responsibly report vulnerabilities in our systems.

Who Can Participate

• Anyone acting lawfully and ethically may participate, except:
  • Employees of PayDo, their relatives.
  • Minors or individuals who are legally incapacitated.
  • Persons, sanctioned by the US, EU, UK and/or UNSC.
  • Those otherwise restricted by PayDo Terms of Service
• Participants must comply with all relevant laws and regulations.
• Participants must not have been banned from using PayDo services.

How to Participate

• Always act in good faith and with the intention of improving security.
• Limit your activities to what is strictly necessary to confirm and demonstrate a vulnerability.
• Use test accounts whenever possible; do not access, store, or share real user data.
• If you accidentally access personal or sensitive information, stop immediately and report it without sharing any details.
• Do not share or disclose any vulnerabilities to third parties until we have resolved the issue.
• Maintain confidentiality regarding all information obtained through your research.

Reporting Process

1. Submit findings via our official website form.
2. Await instructions from our support team.
3. Provide a detailed report with proof of concept.
4. If confirmed, complete identity verification to receive payment within 14 business days.

Rules

• No threats, extortion, or ransom demands.
• Do not disrupt services, use automated tools, or attempt social engineering.
• Only perform actions needed to confirm the vulnerability.
• Do not target other users or physical infrastructure.

Rewards

Scope

The full lists of eligible and non-eligible vulnerabilities are set out in the Bug Bounty Programme Policy. Please refer to the Policy for complete details.

For questions, contact: support@paydo.com

Programme Policy

1. Introduction

PayDo is dedicated to protecting the safety and reliability of its offerings. To bolster our security, we’ve launched a Bug Bounty Programme (referred to as the “Programme“), encouraging security researchers to find and disclose vulnerabilities. Monetary rewards are provided depending on the seriousness of the reported vulnerability. Our Programme promotes a Coordinated Vulnerability Disclosure (CVD) initiative in line with the NIS 2 Directive, improving the security of our IT infrastructure and the protection of our users.

2. Definitions

2.1. “Participant” or “you” means an individual who ethically investigates PayDo’s products and services to identify vulnerabilities, and responsibly reports their findings to PayDo within the terms of the Programme. 

2.2. “PII” means personally identifiable information. 

2.3. “Proof of Concept” means a minimal demonstration that establishes the existence and exploitability of a reported security vulnerability without causing harm, damage, or unauthorised access beyond what is necessary to validate the vulnerability.

2.4. “PayDo” shall have the meaning ascribed to it in the PayDo Terms of Use. 

3. Eligibility and Participation

3.1. Participation in the Programme is voluntary and subject to compliance with this Bug Bounty Programme Policy (hereinafter – “Policy”) and all applicable laws. By participating in the Programme, you confirm that you have read and accepted all terms and conditions outlined in this Policy.

3.2. Participants must act ethically and in good faith, ensuring their actions do not cause harm to PayDo, its users, or its infrastructure, including, without limitation:

1. Be accountable and adhere to the Programme’s conditions;
2. Confine your actions to what is absolutely required to verify the vulnerability’s presence;
3. Do not participate in any intimidation, coercion, or demands for money;
4. Quickly communicate any discovered vulnerabilities, along with unambiguous directions and evidence for exploiting them;
5. Guarantee total adherence to all pertinent legal stipulations during the entire research procedure;
6. For any requests, questions, or the need for further details concerning the Programme, kindly reach out to us via support@paydo.com

3.3. While engaging in the Programme, Participants shall adhere to the following rules:

3.3.1. Test Accounts Usage. To safeguard against potential privacy violations, always use test accounts if feasible. Should you inadvertently gain access to Personally Identifiable Information (PII) or other confidential user details without explicit consent from the account holder, cease data access immediately and inform us. Furnish a description of the PII or sensitive data, but refrain from revealing the specific information itself.

3.3.2. Disclosure of vulnerabilities. Do not disclose vulnerabilities to third parties without PayDo’s written permission.

3.3.3. Ethical Conduct and Rewards. Rewards are granted solely for valid vulnerability disclosures. Error messages must not include threats or demands. However, any demands for information or delaying the resolution of a vulnerability until demands are satisfied will be considered extortion attempts. No compensation will be provided for ransom or other unlawful claims. In instances of extortion, we might be legally required to inform law enforcement authorities

3.3.4. Privacy. Any data, vulnerabilities, research outcomes, details pertaining to your report, or information acquired while researching PayDo’s systems, along with communications exchanged with us (referred to as “Confidential Information“), must be kept private and used exclusively for this Programme. You are prohibited from utilising, revealing, or sharing any Confidential Information without first obtaining explicit written permission from PayDo.

3.3.5. Data protection of customers. Avoid storing or distributing customers’ Personally Identifiable Information (PII). If you happen to access such data, inform us promptly and erase all duplicates. Keep data collection to a minimum, and restrict access to only what is essential for verifying a vulnerability and creating a report. After PayDo confirms that your report has been received, securely eliminate all gathered data.

3.3.6. Data breach notification. Should you identify a security infringement or data location misuse, furnish us with the precise location of the data and immediately halt any access to it. Refrain from disseminating this information to external parties without our express permission.

3.4. Any actions taken to bypass or contravene the Policy will lead to immediate removal from the Programme. In instances involving threats or extortion, details regarding the violator may be disclosed to law enforcement bodies.

4. Reporting Process

4.1. To qualify for a reward within the Programme for identifying a vulnerability, you must adhere to the subsequent steps:

4.1.1. Submit an Initial Request: Visit our official website and complete all necessary sections of the submission form. In your submission, give a concise explanation of the bug you’ve found, making sure to include critical information. Vulnerability reports should not be submitted through unofficial third-party websites, if not directed to by the PayDo Team.

4.1.2. Query Analysis: Our support team will assess and analyse your submission, after which they will provide guidance on the subsequent actions to take. Important: Sharing, publishing, or utilising any information provided for testing purposes by others is prohibited

4.1.3. Submit a Find Report: After receiving the required instructions, submit the requested information through a secure channel, providing detailed information about the vulnerability you identified. Your report must include all evidence as outlined in the guidelines of this Programme.

4.1.4. Report Review: Specialists will review your report within 1-5 working days. We will then inform you of the review outcome.

4.1.5. Identity Confirmation: If your report is confirmed and meets the Programme criteria, a reward amount will be determined based on our assessment scale, as detailed in Section 6. To receive your reward payment, you must provide a copy of your identification, bank account details, and/or complete the verification process as outlined in the PayDo Terms of Service.

4.1.6. Payment: Following successful completion of the requirements outlined in clause 4.1.5., PayDo will process the reward payment to you within 14 working days.

4.2. To be eligible for a reward under this Programme, you must adhere to the subsequent requirements for the vulnerability report:

4.2.1. Your report must contain explicit, step-by-step instructions and a proof of concept to enable us to replicate the vulnerability. If we are unable to verify your findings, no reward will be granted. Use only the information necessary to demonstrate the issue, and promptly return any assets you have accessed.

4.2.2. For all submitted documents, you must provide the following:

1. A comprehensive description of the vulnerability, detailing how it can be exploited and its potential impact.
2. Evidence and an explanation of all steps required to reproduce the vulnerability, including, but not limited to: screenshots, videos, exploit code, Web/API requests and responses, the email address or user ID of the test account, the IP address used during testing, and log files.

4.2.2.1. If you fail to provide either the email address or the user ID of the test account, or the IP address used during testing, your reward will be decreased by 10%.

4.2.3. Any demand for payment or other form of acknowledgment as a prerequisite for providing vulnerability information will result in immediate disqualification from receiving any reward. PayDo retains the right to consider such demands as extortion attempts.

4.2.4. If you fail to fully disclose all relevant details regarding the vulnerability, the submission will also be disqualified from receiving a reward.

4.3. You must adhere to the Submission Rules outlined below for Remote Code Execution (RCE). Failure to meet these requirements may result in forfeiture of the reward:

1. Timestamp (including time zone). 
2. Source IP address. 
3. Callback IP address and port (if applicable). 
4. Full server request and response.
5. Names of downloaded (uploaded) files containing “bugbounty” text and a timestamp.
6. Data accessed intentionally or unintentionally. 

5. Allowed and Prohibited Actions of the Participant

5.1. By taking part in the Program, you are permitted to run safe and limited system commands via a web interface or application (such as, but not restricted to, “whoami”, “hostname”, or “ifconfig”).

5.2. While participating in the Program, the following actions are strictly forbidden:

• Causing disruption to normal system functionality (e.g., initiating system restarts).
• Downloading files that could enable the execution of unauthorized or arbitrary commands (e.g., deploying a web shell).
• Accessing files or information unrelated to verifying security vulnerabilities.
• Altering or erasing data or files in any way.
• Establishing and maintaining ongoing remote access to the server.
• Failing to report actions taken or information discovered during testing.

5.3. By participating in the Programme, you are strictly prohibited from engaging in or conducting the following types of testing or activities:

1. Automated testing of web forms, including but not limited to “Contact Us” forms, is prohibited. 
2. The use of automated scanners and vulnerability detection tools is strictly prohibited.
3. Conducting any attacks designed to damage, disrupt, or impair services, including but not limited to distributed denial-of-service (DDoS) attacks or the transmission of unsolicited bulk communications (spam), is prohibited. 
4. Testing the physical security of PayDo offices or equipment is strictly prohibited.
5. Modifying or adding random content to the service.
6. You may test with your own account or test accounts, but it is prohibited to violate or compromise other people’s data.
7. Targeting end users or engaging in the acquisition, use, or trade of stolen credentials is prohibited.  

5.4. You are strictly prohibited from disclosing any vulnerabilities related to PayDo to any third party. Attempts to bypass these rules, or any part thereof, will lead to the immediate cancellation of any reward payments.

5.5. If, during testing, you unintentionally cause a privacy breach affecting PayDo, such as accessing credentials or other sensitive information, you are required to immediately disclose the details of this incident in your report or email to support@paydo.com

6. Rewards

6.1. The details regarding the severity level of the vulnerability can be found in the table below:

6.2. Rewards are determined by PayDo based on the severity of the vulnerability, in accordance with the scale below:

6.3. All decisions concerning reward payments are at the sole and absolute discretion of PayDo and are final. Consult the “Out-of-Scope Vulnerabilities” section for findings that are not eligible for rewards. Your participation in the Programme confirms your agreement to all of its terms and conditions.

7. In-Scope Vulnerabilities

7.1. The following are considered in-scope vulnerabilities:

• Cross-Site Scripting (XSS): Vulnerabilities that enable malicious scripts to run in a user’s browser, potentially leading to data theft or unauthorized actions.
• Privilege escalation (horizontal/vertical): Attacks that allow an attacker to elevate access rights—either within the same user level (horizontal) or to a higher privilege level (vertical).
• File history tampering: Any manipulation that alters a file’s version history.
• Infrastructure access: Attacks that provide access to sensitive data or credentials that are insufficiently protected.
• SQL Injection: Inserting malicious SQL statements into database queries, potentially causing data exposure or system manipulation.
• Unauthorized access to shared files: Any method that enables access to shared files without having the proper access key.
  Remote Code Execution (RCE): The ability to execute arbitrary code on a server or device remotely.
• CORS with actual security consequences: Violations of Cross-Origin Resource Sharing (CORS) policies that can lead to data leaks or unauthorized actions.
• Cross-Site Request Forgery (CSRF): Forcing an authenticated user to perform actions without their knowledge.
  Bypassing workspace permissions: Performing actions such as editing read-only documents or adding users without the appropriate permissions.
  Authentication bypass and failures: Exploiting flaws in the authentication process to gain unauthorized access.
• Open redirect vulnerabilities: Exploiting flaws in the platform’s redirection mechanisms to send users to malicious websites.
• Business logic flaws with security impact: Issues caused by incorrect implementation of business logic that can be exploited to gain unauthorized access or affect application behavior.
• Exposure of secrets, credentials, or confidential data: Accessing sensitive information due to improperly protected objects on the platform.
• Account recovery abuse: Gaining account access through weaknesses in the password recovery or account recovery processes.
• Unauthorized access to messages or files: Exploiting weaknesses to access files or conversations within a workspace without permission.
• Insecure Direct Object Reference (IDOR): Gaining access to files or data by manipulating request parameters.
• Local file access and manipulation (LFI, RFI, XXE, SSRF, XSPA): Exploiting vulnerabilities to access or manipulate local files or internal services.

8. Out-of-Scope Vulnerabilities

8.1. The following types of vulnerabilities are not eligible for rewards under this program:

• Vulnerabilities relying on physical access to a user’s device to initiate or authorize payment activity.
• Abuse of known bugs already submitted by others; only the first valid report qualifies for a reward.
• Brute-force attempts, DoS attacks, or a lack of rate-limiting impacting payment-related systems.
• Outdated third-party libraries with no proven threat to the security of payment operations.
• Theoretical issues or non-standard practices that lack functional exploit demonstrations.
• The use of social engineering techniques to obtain sensitive payment information from staff or contractors.
• Reports relying solely on automated tools or AI-generated analysis with no actionable proof of concept.
• Autofill settings in payment form fields, unless they result in demonstrable unauthorized actions.
• Data leaks such as stack traces or server paths that do not compromise the security of financial transactions.
• Security gaps in payment-related applications that demand high levels of user interaction to exploit.
• Misuse of internal package names in code interpreters that does not result in executable payment manipulation.
• Problems within deprecated or unpatched browsers that are unrelated to modern payment security.
• Attempts to circumvent geo-restrictions or IP bans using VPNs or similar tools.
• Vulnerabilities discovered in blog subdomains or informational sections not tied to actual payment processing (e.g., blog.paydo.com).
• Gaps in TLS configuration or SSL settings without a working PoC affecting the payment infrastructure.
• Known CVEs for payment platforms without publicly available, exploitable Proof of Concept code.
• Attempts to impact payment systems using social engineering, spam, phishing, or physical intrusion tactics.
• Suggestions aimed at improving security hygiene or best practices without identifying specific flaws.
• Insecure default settings (e.g., HTTP headers like HSTS) that lack demonstrable security impact on transactions.
• Client-side issues where users remain connected indefinitely, enabling potential but unproven threats.
• Disclosure of payment software versions or server error responses not tied to confirmed vulnerabilities.
• Vulnerabilities that cannot be reproduced reliably on the tested payment platform.
• Clickjacking attempts on financial interfaces unless they result in actual unauthorized actions.
• Security reports regarding the structure or versioning of the payment backend without exploit context.
• Email delivery or anti-spam protocol flaws (like SPF, DMARC, DKIM) that do not compromise payment systems.
• Usage of outdated encryption suites (SSL/TLS ciphers) without practical exploitation scenarios.
• Reports requiring physical presence or manipulation of office systems, Wi-Fi networks, or hardware.
• Exploits dependent on outdated or obsolete browsers used in the payment process.
• Attacks launched using previously leaked or stolen account credentials.
• Unpatched 0-day vulnerabilities disclosed within 30 days that are still under review or mitigation.
• Errors in password policies (length, complexity, reuse) unless they directly weaken payment account security.
• Bugs present only in third-party platforms or tools that interface with, but are not maintained by, PayDo.
• Lack of rate-limiting or measures to prevent spam (email, SMS, messaging) unless impacting transaction integrity.
• Code execution in sandboxed or isolated environments that does not result in unauthorized financial operations.
• Accessing user data (email, name, transaction history) if the role-based access control permits it legitimately.
• Misconfigurations in tab handling during payment steps that don’t lead to exploitable actions (e.g., tabnabbing).
• Issues stemming from recently released updates (less than 30 days) in core payment components or dependencies.
• Proof-of-concept bypasses of API key restrictions that involve manipulating external service configurations.
• Vulnerabilities in payment system APIs used by third-party software unless affecting PayDo’s core services.
• Generic flaws such as missing security headers, unless tied directly to a validated exploit scenario.
• Reports that lack clear, reproducible steps and a working exploit targeting the payment system.
• Suggestions or guidelines around TLS suite choices not backed by exploitation of weak settings.
• Any form of data manipulation, destruction, or unauthorized access that affects payment data not belonging to the reporter.

9. Duplicate or Similar Reports

9.1. After a vulnerability report, PayDo will allow a suitable period to fix the problem on all impacted host instances. Should you discover the same vulnerability on a different (distinct) host before the report is resolved, add it to the existing report to receive an extra 5% bonus per host (not per domain). Any new reports for the same vulnerability on other hosts submitted during the remediation process will be treated as duplicate submissions.

9.2. PayDo has the exclusive right to decide if rewards for related vulnerability discoveries (like the same vulnerability impacting different resource parameters, or several attack methods exposing a central infrastructure problem) will be paid as one combined reward. To help with quick processing, Participants should combine these discoveries into a single report.

9.3. PayDo will not give rewards for vulnerabilities already reported by other Participants or already known to PayDo.

10. Legal and Compliance

10.1. Compliance with Laws and Policies. Participants are required to follow all relevant laws and regulations (including those related to privacy and data processing), as well as PayDo’s Terms and Conditions, and Privacy Policy.

10.2. Eligibility Requirements. The Programme is not open to PayDo employees, their family members, minors or people lacking legal capacity, and anyone barred from using PayDo services according to the PayDo Terms of Service.

10.3. Policy Amendment. PayDo can change the terms of this Policy at any time, without telling Participants beforehand. The updated Policy will be published on PayDo’s website. If you continue to participate in the Programme, it means you accept any changes to this Policy.

10.4. Safe Harbour. PayDo will not start legal proceedings against you regarding actions carried out according to the rules in this Policy, and which are reported to PayDo under this Programme. If a third party starts legal action against you concerning actions that comply with this Policy, we will take reasonable steps to make it known that you acted under the Programme. Before doing anything that might not comply with or is not clearly addressed in this Policy, please report it to PayDo for clarification.

10.5. Report Ownership. You give PayDo, its subsidiaries, affiliates, and customers a lasting, unchangeable, global, royalty-free, transferable, and sublicensable (through many levels) non-exclusive right to use, reproduce, adapt, change, publish, distribute, publicly perform, create derivative works, manufacture, use, sell, offer for sale, and import the Report, and any materials given to PayDo with it, for any reason.

10.6. Indemnification and liability. You agree to defend, indemnify, and hold harmless the PayDo, its subsidiaries, affiliates, and its officers, directors, agents, joint venturers, employees, contractors and suppliers from and against any claims or demands (including attorneys’ fees) made by or arising from any third party as a result of your report, your violation of the terms of this Programme, and/or your improper use of this Programme. PayDo shall not be liable to You or any third party for any liability, claims, damages, losses, costs, expenses or other obligations whatsoever (whether direct, indirect, special, incidental, consequential or otherwise) that may arise out of or in connection with the Programme and/or the Policy, howsoever caused and regardless of the form of action, whether in contract, tort (including negligence), or otherwise.

10.7. Termination. If you break any terms of this Programme and/or Policy, or PayDo decides, at its own discretion, that your ongoing participation could harm PayDo (including, but not limited to, threatening its systems, security, finances, and/or reputation), then PayDo can immediately end your participation in the Programme and cancel your eligibility for any rewards.

10.7.1. PayDo holds the right, at its sole and absolute discretion, to end and/or change the Programme and/or this Policy at any time and for any reason, or for no reason at all, without having to notify You beforehand or provide any explanation for ending it.

10.8. Governing law and dispute resolution. The Programme, Policy, and any related matters are governed by and interpreted according to the laws of England and Wales. Any disputes related to the Programme and Policy will be resolved through discussions in good faith to reach a friendly agreement. If an agreement cannot be reached, the Parties agree to the exclusive jurisdiction of the competent courts of England and Wales for the final resolution of the matter.