-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Contact: mailto:blue112@chapatiz.com Expires: 2026-12-31T23:00:00.000Z Encryption: https://www.chapatiz.com/.well-known/pub-key.txt Preferred-Languages: fr, en Canonical: https://www.chapatiz.com/.well-known/security.txt OpenBugBounty: https://openbugbounty.org/bugbounty/chapatiz/ == Bug bounty program Please adhere to the following rules while performing research on this program: Denial of service (DoS) attacks on Chapatiz applications, servers, networks or infrastructure are strictly forbidden. Avoid tests that could cause degradation or interruption of our services. Do not use automated scanners or tools that generate large amount of network traffic. Do not leak, manipulate, or destroy any user data or files in any of our applications/servers. Do not copy any files from our applications/servers and disclose them. No vulnerability disclosure, full, partial or otherwise, is allowed. = General requirement Always send a working proof of concept for any vulnerability you find. If possible, include the CVSS score. = Testing requirement You can create an account on the website to auth. Please do not speak in a public chat room in a language other than french and please respect the website moderating team. You can speak in private in any language you want. You can create as many account as you wish, as long as you do not abuse the website rules with them. Please refer to the website rules for more informations: https://www.chapatiz.com/rules/ = Max rewards for each type of vulnerability Critical vulnerability: 1000 euros High-risk vulnerability: 500 euros Medium-risk vulnerability: 100 euros Low-risk vulnerability: 50 euros = Reward egibility We are happy to thank everyone who submits valid reports which help us improve the security of Chapatiz, however only those that meet the following eligibility requirements may receive a monetary reward: You must be the first reporter of a vulnerability. The report must be in french or in english language. The vulnerability must be a qualifying vulnerability (see below). The report must contain the following elements: Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and Chapatiz Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc You must not break any of the testing policy rules listed above = Qualifying vulnerabilities SQL Injection (SQLi) Cross-Site Scripting (XSS) Remote Code Execution (RCE) Insecure Direct Object Reference (IDOR) Horizontal and vertical privilege escalation Authentication bypass & broken authentication Business Logic Errors vulnerability with real security impact Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA) Cross-Origin Resource Sharing (CORS) with real security impact Cross-site Request Forgery (CSRF) with real security impact Open Redirect with real security impact = Non-qualifying vulnerabilities Tabnabbing Missing cookie flags Content/Text injections Mixed content warnings Clickjacking/UI redressing Denial of Service (DoS) attacks Known CVEs without working PoC Open ports without real security impact Social engineering of staff or contractors Presence of autocomplete attribute on web forms Vulnerabilities affecting outdated browsers or platforms Self-XSS or XSS that cannot be used to impact other users Outdated libraries without a demonstrated security impact Any hypothetical flaw or best practices without exploitable PoC Expired certificate, best practices and other related issues for TLS/SSL certificates Unexploitable vulnerabilities (ex: XSS or Open Redirect in HTTP Host Header) Reports with attack scenarios requiring MITM or physical access to victim's device Missing security-related HTTP headers which do not lead directly to a vulnerability Unauthenticated / Logout / Login and other low-severity Cross-Site Request Forgery (CSRF) Invalid or missing SPF (Sender Policy Framework), DKIM, DMARC records Session expiration policies (no automatic logout, invalidation after a certain time or after a password change) Disclosure of information without direct security impact (e.g. stack traces, path disclosure, directory listings, software versions, IP disclosure, 3rd party secrets) CSV injection HTTP Strict Transport Security Header (HSTS) Subdomain takeover without a full working PoC Blind SSRF without direct impact (e.g. DNS pingback) Lack of rate-limiting, brute-forcing or captcha issues User enumeration (email, alias, GUID, phone number) Password requirements policies (length / complexity / reuse) Ability to spam users (email / SMS / direct messages flooding) Recently disclosed 0-day vulnerabilities (less than 30 days since patch release) Password reset token leak on trusted third-party website via Referer header (eg Google Analytics, Facebook) -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEExeW1YKwyo51bHucGUYUVWhoUI/8FAmeA3VEACgkQUYUVWhoU I/99Ywf/dKhihU3YhyqPWYl/NPtZJv3BO5uTacDca47xMfr9LdaxCV+UNdZc4Rhs fGCAfYKCh7OwmxhdWYVUswr7LNNOOfkC9nNhwg3Cqqrp/INv10WggSQNryFvmtcc B2fdlAAjCV7BFjkgeO9N95vPhW5qg/X9G1CNUi0cf0CwAlVfjINaS8ffWCp/c2Vy rZrdUn5ka69ZMmDTyR1/zC0OosYoUcD8mNW8PAMvXHgE+c7NqSNbdtNFvGk1sBra shRdIjr5D/DeySHn2zpR1Co1hHyOii02UtScBUwV+qjyBHSNgKf4Xtd/bgesNuV/ KEomCm5lfmQFlE6eOjeTxVnUhJmImQ== =NXy6 -----END PGP SIGNATURE-----