Ukraine flag We stand with Ukraine. To make an impact, please consider donating.
Log In
Register
Log in
Sign up

Bug bounty program

Report Bug

Banqeo is determined to ensure secure environment for its users. Although our IT specialists are doing their best to find every possible vulnerability on our platform, there is always a slight possibility that a few of them could have been overlooked. Thus, we decided to introduce a bug bounty program. Every Banqeo user can take part in the program and earn rewards by reporting the bugs they find in our system.

Rewards

Banqeo has not set a maximum reward for the vulnerabilities reported — higher rewards may be allocated depending on the severity of a reported bug. We distribute the bounties in accordance with the following guidelines, however, the determination of the final amount remains at our discretion. The rewards for eligible bugs are paid in Bitcoin or Ether.

The reward may be increased based on:

  • Quality of the description. Higher rewards may be paid for clear, well-written bug bounty reports.
  • Quality of the proof of concept. Higher rewards may be paid if testing code, scripts and detailed instructions are included.
  • Quality of the fix, if included. Higher rewards may be paid if suggestions on fixing the issue are provided.

Only unknown and previously unreported vulnerabilities are considered for rewards.
We only reward one bounty per bug. If multiple reports are submitted for the same vulnerability, we will reward the first reporter only.
To receive a reward, there must be no legal obstacle to do so (e.g. you may not participate in this program if you are a resident or individual located within a country subject to international sanctions including but not limited to EC, FATF, US, UN.)
In any case Banqeo has the discretion to determine a reported vulnerability as insignificant, including its eligibility for the reward. By submitting a bug, you agree to follow the rules above.

How to report a bug

  1. Bug report should contain a detailed step-by-step proof of concept that would allow us to reproduce and evaluate the issue. For example, a web-related report should contain at least:

    • HTTP requests/responses together with affected parameters
    • Screenshots or videos (if necessary)
    • Description of the browser (type), OS, device and/or app version
    • Description of the perceived impact of the vulnerability
    • Suggestions on how to solve the issue (optional)

  2. Do not publicly share any files and/or details related to the vulnerability. This includes uploads to any publicly accessible websites (i.e. YouTube, Imgur, Pastebin, etc.).

  3. Encrypt your message and any attachments by using our PGP Public Key (available below).
  4. Include your BTC/ETH address for payment.

  5. Send your vulnerability reports to email@example.com.

If our IT Security team cannot reproduce and verify the issue, the bounty will not be allocated.

Eligibility (Scope)

All services provided by Banqeo are eligible for our bug bounty program, including the iOS and Android Banqeo apps, Banqeo Wallet, API, Merchant Tools, Cards and Exchange. In general, vulnerabilities that have the potential for financial loss or data breach are considered of sufficient severity, including but not necessarily:

  • Cross-Site Request Forgery (CSRF)
  • Cross-Site Scripting (XSS)
  • Code Injection
  • Remote Code Execution
  • Privilege Escalation
  • Authentication Bypass
  • Clickjacking
  • Leakage of Sensitive Data

Ineligibility (Out of Scope)

In general, the following vulnerabilities do not meet the severity threshold:

  • Lack of DNSSEC
  • Host header injection without a specific and demonstrable impact
  • Flash based exploits
  • CSRF on forms that require no authentication or on non sensitive actions
  • Clickjacking on pages with no sensitive actions
  • Vulnerabilities that require Man-in-the-middle attack (MITM), or physical access to a user’s web browser, email account, smartphone and issues on rooted/jailbroken devices

Responsible disclosure

  1. Providing us a reasonable amount of time to fix the issue before publishing it elsewhere.

  2. Non-violation of the privacy of other users, destroying any data or disrupting our services, etc. (acting in good faith).

  3. Not defrauding Banqeo users (do not interact with an individual account which includes modifying or accessing data from the account) or Banqeo itself in the process of discovery.

  4. For exploits that need account access you must use your own account.

  5. If you inadvertently access private data, we ask that you delete all related information, including but not limited to access codes, private data, etc., after notifying us.

  6. If in the case of a bug you were able to access and/or move funds from Banqeo, you commit to returning the whole amount to Banqeo.
* To encourage responsible disclosure, we are not going to start legal action against the researchers who point out a problem provided they do their best to follow the guidelines above.

Help us keep Banqeo safe

Report Bug

Products

About

Support

Community

Get in Touch

  • helpdesk@banqeo.com

Please note that you should not construe any information provided by Banqeo, in the course of your use of the Banqeo services, as legal, tax, investment, financial, or other advice. Nothing contained on the Banqeo webpage constitutes a solicitation, recommendation, endorsement, or offer by Banqeo or any third-party service provider to buy or sell any digital assets or financial instruments in any jurisdiction.

All or part of the Banqeo Wallet Services, some features thereof, or some Digital Assets, are not available in certain jurisdictions, including where restrictions or limitations may apply, as indicated on the Banqeo Platform and in the relevant general terms and conditions.

Copyright © 2022 Banqeo. All rights reserved