漏洞懸賞計畫

MaiCoin

修改於：星期五, 28 十月, 2022 在 2:05 PM

計畫範圍、政策和獎金

範圍

www.maicoin.com (https://www.maicoin.com/)
max.maicoin.com (https://max.maicoin.com/)
api.maicoin.com (https://api.maicoin.com/)
max-api.maicoin.com (https://max-api.maicoin.com/)
Android: com.maicoin.maicoin (https://play.google.com/store/apps/details?id=com.maicoin.maicoin)
Android: com.maicoin.max (https://play.google.com/store/apps/details?id=com.maicoin.max)
iOS: MaiCoin https://itunes.apple.com/tw/app/id1439583926
iOS: Max https://itunes.apple.com/tw/app/id1370837255

政策

請提供MaiCoin詳細的漏洞報告並包含可重現漏洞的步驟。
請給予MaiCoin合理的時間執行修補計畫並修復漏洞。
未經MaiCoin事前書面同意，請勿揭露任何漏洞、任何您回報給MaiCoin的資訊，及任何MaiCoin回饋給您關於漏洞的資訊予任何第三方。即使該漏洞已被修補，亦同。
請勿嘗試瀏覽、更動或是破壞屬於其他使用者的資料。
MaiCoin得隨時單方終止本計畫或修改本計劃的所有條款和規定。

同時，您必須符合下列所有條件，才有資格獲得獎金：

您是第一位回報特定安全性漏洞的研究人員。
您回報的安全性問題經確認為可驗證、可重現、可利用且包含在計畫範圍內。
您遵守本計畫的所有條款和規定。
您於本計畫終止之前回報。

另外，所有下列相關的漏洞皆不在本計畫範圍內:

Social engineering(e.g. phishing).
Physical security.
Non-security-impacting UX issues.
Deprecated Open Source libraries are not in scope. If you would like to report a vulnerability for one of these libraries, please submit it on GitHub via an issue or PR.
Missing best practices in SSL/TLS configuration.
Self-XSS and issues exploitable only through Self-XSS.
Clickjacking on pages with no sensitive actions.
Related to tab-jacking, tab-nabbing, and text injection.
Related to DNS over HTTPS, DNSSEC, and DNS CAA record.
Attacks requiring MITM, physical access or privileged access(e.g. root a phone) to a user's device.
Any activity that could lead to the denial/degradation of service (DoS).
Enforcement policies for brute force or account lockout.
Missing security headers.
Unauthenticated/logout/login CSRF.
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
Unconfirmed reports from automated vulnerability scanners.
Disclosure of server or software version numbers.
Disclosure of known public files and other information disclosures that are not a risk (e.g. robots.txt).
Disclosure of information with minimal security impact (e.g. stack traces, path or directory listing, logs).
Theoretical sub-domain takeovers with no supporting evidence.
Vulnerabilities or weaknesses in third party applications that integrate with MaiCoin.
Issues only present in end-of-life software.
Ability to abuse existing banking functionality.
Exposure of the IP address or domains.
Spamming or Un-limiting Email rate.

本計畫的參與者不得:

侵犯其他人權利或是法律的任何行為
寄送垃圾郵件給MaiCoin使用者
使用發現的漏洞閱覽、刪除、修改或揭露其他使用者的資料
使用發現的漏洞閱覽、刪除、修改或揭露系統原始碼
任何上列行為以外，違反本計畫精神與目的的行為

MaiCoin會盡最大努力遵守以下回應時間目標:

回應類型	工作日
初次回應	3日
初步分類	7日
獎勵發放	30日

有關本計畫的詢問:

所有相關的詢問均應發送至 bounty@maicoin.com，使用其他方式發出的詢問皆不會收到任何回應。

漏洞調查與回報:

發現安全性問題，請使用 bounty@maicoin.com 聯絡我們。回報安全弱點時，請使用MaiCoin提供的PGP金鑰加密漏洞資訊。MaiCoin安全團隊將於三個工作日內回覆您，並依據問題的嚴重性儘速修正問題。

PGP Key:

獎金

獎金表:

嚴重等級	獎金(USDT)
嚴重	3000
高	750
中	150
低	30

獎金將會使用USDT或等值的新台幣支付，當您提出的漏洞被確認並接受後，請提供以下任一資訊作為領取獎金的管道:

您的 USDT 錢包地址
您的新台幣銀行帳戶

漏洞等級描述:

MaiCoin認為”嚴重”風險等級的漏洞包含:

Read /write sensitive data in a system.
SQL injection
Remote arbitrary code execution
Vertical authentication/authorization bypass
Exfiltrate digital or fiat currency
And other critical-severity issues

MaiCoin認為”高”風險等級的漏洞包含:

Server-side request forgery to an internal service
Stored/Reflected XSS in the core service
Lateral authentication/authorization bypass
And other high-severity issues

MaiCoin認為”中”風險等級的漏洞包含:

Cross-site request forgery
Server-side request forgery
Sensitive information/data disclosure
Server misconfiguration or provisioning errors with the immediate risks
Arbitrary file upload with the immediate risks
And other medium-severity issues

MaiCoin認為”低”風險等級的漏洞包含:

Server misconfiguration or provisioning errors
Found demo/example configuration
General information disclosure
And other low-severity issues