Bitcoin Forum
August 18, 2018, 04:21:44 AM *
News: Latest stable version of Bitcoin Core: 0.16.2  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: [1]
  Print  
Author Topic: ANNOUNCEMENT: PikaPay.com Vulnerability Bounty Program  (Read 2830 times)
pikapay
Full Member
***
Offline Offline

Activity: 164
Merit: 101


@PikaPay - Easy as a Tweet!


View Profile WWW
March 18, 2013, 11:09:13 AM
 #1

PikaPay.com Vulnerability Bounty Program

Reward payouts from between 0.001 and 100 BTC for reporting security vulnerabilities.

We invite security specialists and the community at large to participate in our bug rewards program.

One of the keys to the widespread adoption of Bitcoin is security.

Together we can redefine the future of online cash by making Bitcoin easy and safe enough for anyone to use.  Help us improve privacy and security and bring the benefits of Bitcoin to everyone.

To take part in this hacking competition, please read the program guidelines here.

Forum members are also welcome to participate in our beta test.  See details below.

If you want to make feature requests or any other suggestions, mail them to hello@pikapay.com.



The Bounty Program

Summary, or How to Participate in 3 Easy Steps

First, sign in to PikaPay's mobile web application via pikapay.com

Second, refer below to the terms of the reward program.

Third, if you believe you have discovered a bug or vulnerability in PikaPay or have encountered a security incident, report it to security@pikapay.com.


Background

PikaPay: A system for exchanging virtual currency using open source technology and social media.

We launched the first Bitcoin to Twitter application, a tipping system, more than 18 months ago.  We are now opening our Twitter payment service, PikaPay, to an invitation-only beta program.  Visit PikaPay.com to request an invitation, or use PikaPay.com to just start testing immediately.

The PikaPay Security Team will maintain a bounty program to encourage security investigation that can be used to benefit the Bitcoin community.

Scope

Any web services operated by PikaPay are considered in scope for this program.

The following list of bugs will likely qualify for a reward:

Any fault in PikaPay services that substantially compromises the integrity or confidentiality of user data.  Some examples that fall into this category:


  • Authentication and authorization mechanism faults;
  • Command injection bugs;
  • Cross-site scripting, cross-site script inclusion and cross-site request forgery;
  • Mixed scripting; and
  • Server-side code execution.


Some examples that do not merit a reward:

  • Application of SEO tactics;
  • Attacks on physical facilities or PikaPay infrastructure;
  • Brute force denial of service faults;
  • Involvement of social engineering;
  • Vulnerabilities in non web applications and in services operated by third parties.

There are also exceptional cases -- such as bugs that are repeatable only through the use of out-of-date browsers or plugins -- which will also not qualify for a reward.

For the sake of PikaPay's availability, you are asked to avoid using any tools that create unusual amounts of traffic or conducting any behavior that will disrupt other users.

Payouts

Reward payouts range from between 0.001 and 100 BTC. Decisions concerning the rewards are made at PikaPay's sole discretion.  For example, PikaPay may elect to pay out higher rewards for the discovery of unusually severe or skillful exploits.

Disclosure

PikaPay will cooperate with a coordinated bug disclosure policy, and will make best efforts to respond to vulnerabilities as soon as possible after receiving advance notification.  Parties who do not observe this policy or who do not avoid disclosing flaws to third parties will most likely be disqualified from receiving a reward.

Only the first person to report a previously undiscovered vulnerability will qualify for a reward, although smaller bounties may still be given to other contributors.

We plan to acknowledge all significant contributors publicly unless you tell us you prefer to remain anonymous.  You can also elect to receive a reward anonymously or to have it paid to a charitable cause of your own choosing.  If a reward is not claimed within 30 days, it will be donated to ProjectPika, to support preservation of the pika species.

BitcoinWednesday.com - The monthly conference on the digital currency revolution in The Netherlands.

Every 1st Wednesday of the month in Amsterdam: Meetup.com/BitcoinWednesday

---------------------


- The Easiest Way to Send Bitcoin to Anyone on Twitter
The future of cash has no borders.
1534566104
Hero Member
*
Offline Offline

Posts: 1534566104

View Profile Personal Message (Offline)

Ignore
1534566104
Reply with quote  #2

1534566104
Report to moderator
1534566104
Hero Member
*
Offline Offline

Posts: 1534566104

View Profile Personal Message (Offline)

Ignore
1534566104
Reply with quote  #2

1534566104
Report to moderator
1534566104
Hero Member
*
Offline Offline

Posts: 1534566104

View Profile Personal Message (Offline)

Ignore
1534566104
Reply with quote  #2

1534566104
Report to moderator
BOUNTY PORTALS
BLOG
WHERE BOUNTY MANAGEMENT
MEETS AUTOMATION
SIGNATURE CAMPAIGNS
TWITTER
FACEBOOK
MEDIA CAMPAIGNS
AND MORE!
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
pikapay
Full Member
***
Offline Offline

Activity: 164
Merit: 101


@PikaPay - Easy as a Tweet!


View Profile WWW
March 27, 2013, 11:30:57 AM
 #2


Update

Thanks to everyone for the excellent feedback in the first week of this program.  We've already privately acknowledged the submissions we've received so far.  Some are eligible for bounties.

We plan to release a preliminary report of our findings very soon -- just watch this space.

In the meantime, we look forward to reports of new vulnerabilities and ZTs:  security@pikapay.com


Beta Test

Forum members interested in taking PikaPay for any early test drive, mail hello@pikapay.com or ask @PikaPay for #bitcoin if you'd like to get an invite.

BitcoinWednesday.com - The monthly conference on the digital currency revolution in The Netherlands.

Every 1st Wednesday of the month in Amsterdam: Meetup.com/BitcoinWednesday

---------------------


- The Easiest Way to Send Bitcoin to Anyone on Twitter
The future of cash has no borders.
pikapay
Full Member
***
Offline Offline

Activity: 164
Merit: 101


@PikaPay - Easy as a Tweet!


View Profile WWW
May 06, 2013, 09:55:16 PM
 #3


Two Updates

First, a reward has been paid for the lone vulnerability discovered back in March.  The Bounty Program continues for interested parties.

Second, please see https://bitcointalk.org/index.php?topic=197295.msg2052985#msg2052985 for the latest developments on PikaPay's new Bitcoin API.

BitcoinWednesday.com - The monthly conference on the digital currency revolution in The Netherlands.

Every 1st Wednesday of the month in Amsterdam: Meetup.com/BitcoinWednesday

---------------------


- The Easiest Way to Send Bitcoin to Anyone on Twitter
The future of cash has no borders.
ASICPool
Member
**
Offline Offline

Activity: 80
Merit: 10



View Profile
May 07, 2013, 01:22:49 AM
 #4

Sent in my first of (hopefully) many!

Cheers!
pikapay
Full Member
***
Offline Offline

Activity: 164
Merit: 101


@PikaPay - Easy as a Tweet!


View Profile WWW
July 14, 2013, 10:10:13 AM
 #5


We've just now announced payout for two vulnerabilities and a third unofficial bounty.

For details see http://j.mp/1bcgQ5O

BitcoinWednesday.com - The monthly conference on the digital currency revolution in The Netherlands.

Every 1st Wednesday of the month in Amsterdam: Meetup.com/BitcoinWednesday

---------------------


- The Easiest Way to Send Bitcoin to Anyone on Twitter
The future of cash has no borders.
pikapay
Full Member
***
Offline Offline

Activity: 164
Merit: 101


@PikaPay - Easy as a Tweet!


View Profile WWW
September 08, 2013, 11:08:39 AM
 #6

Update 8 September 2013

We've just now announced payout for reports submitted since July.

https://bitcointalk.org/index.php?topic=290111.new#new


BitcoinWednesday.com - The monthly conference on the digital currency revolution in The Netherlands.

Every 1st Wednesday of the month in Amsterdam: Meetup.com/BitcoinWednesday

---------------------


- The Easiest Way to Send Bitcoin to Anyone on Twitter
The future of cash has no borders.
pikapay
Full Member
***
Offline Offline

Activity: 164
Merit: 101


@PikaPay - Easy as a Tweet!


View Profile WWW
September 08, 2013, 11:29:32 AM
 #7

Update

Instructions

With all reports you submit, please provide direct, specific (not theoretical) evidence of the vulnerability, including exact steps to reproduce it.
We require a written step-by-step explanation of how your reported issue can actually be exploited.

The specificity, completeness and clarity of your communication will be taken into account in evaluating the severity of your reported vulnerability for a possible bounty.

We value all contributions but are specifically looking for reports that can demonstrate a very specific viable vulnerability with respect to our application much more than a general or theoretical finding.  The latter is also appreciated but may not be evaluated the same way.


Acknowledgements

All acknowledgements will be publicly reported to BitcoinTalk.

With every submission please include your Bitcoin address or your Twitter Name for possible payment.

If you would like to be publicly acknowledged for your findings please also let us know if there is a preferred name you would want us to use in the announcement.




BitcoinWednesday.com - The monthly conference on the digital currency revolution in The Netherlands.

Every 1st Wednesday of the month in Amsterdam: Meetup.com/BitcoinWednesday

---------------------


- The Easiest Way to Send Bitcoin to Anyone on Twitter
The future of cash has no borders.
Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!