Bug Bounty Policy

This policy operates in coordination with the Cybersecurity Incident Disclosure Policy at trust-and-security/cybersecurity-incident-disclosure-policy.md. Submissions that meet the materiality threshold under that policy are escalated through the Cybersecurity Incident Disclosure process in addition to the bug-bounty workflow described here.

This policy sets the rules for security researchers to test and report vulnerabilities to Tanqory safely. Read together with the Vulnerability Disclosure Policy, Incident Response Plan, and Terms of Service. The English version is authoritative; if conflicts arise, the stricter law or the more specific/latest document prevails.

Status notice — Program Launch Pending. The bounty program described below, including the dedicated submission portal referenced as security.tanqory.com/bounty and the cash-reward schedule in Section 4, activates only when the portal goes live and an https://security.tanqory.com/.well-known/security.txt record is published. Until that date, researchers should submit reports by email to security@tanqory.com under the Vulnerability Disclosure Policy (VDP); the Safe Harbor commitments in Section 6 apply on receipt. Cash bounties are not paid for reports submitted before the portal goes live. Tanqory will update this page (effective date and version) when the program is activated.

1) Purpose

Enable the community to find and fix vulnerabilities proactively, reduce risk to data/availability, and reward fairly by severity/business impact. The program follows ISO/IEC 29147, ISO/IEC 30111, OWASP/ASVS, and CVSS; supports coordinated disclosure; tracks TTR/TTC; feeds the risk register; and evidences trustworthy handling to customers/partners.

2) Scope

• In scope: Tanqory-controlled domains/services (main web, APIs, mobile app, checkout/payments, authentication/accounts, admin/merchant/partner portals). Current list at https://security.tanqory.com/bounty.
• Out of scope: third-party services (e.g., Cloudflare, AWS, Stripe), corporate email infra, social engineering, physical security, real employee/customer accounts, any production customer data.
• Use test accounts and synthetic data only; no touching real customer data.
• Sandbox/staging scope (if any) will be listed separately and may limit tools/traffic.
• Respect data residency/contract constraints if regional data is encountered.
• No destructive PoC (e.g., data deletion, transaction tampering).
• We may pause testing during maintenance/emergencies and will announce via the bounty portal/email.
• Scope changes take effect after ≥7 days’ notice unless security emergencies require faster action.
• Automated scanning must rate-limit and stop on HTTP 429.

3) Eligibility

• 18+ or parental consent where required by local law.
• Not on sanctions lists (OFAC/EU/UN) and not restricted from financial transactions.
• Not a current employee/contractor or immediate family within the last 12 months unless explicitly approved.
• Register and be validated by security@tanqory.com; accept Rules of Engagement.
• No prior ban from this or reputable external programs (case by case).
• Accept KYC/tax steps to receive bounties and consent to personal data processing for payment/audit.
• Disclose conflicts (e.g., internal access); restrictions may apply.
• Comply with local cyber/data laws as well as Singapore law.

4) Severity & Rewards

• CVSS v3.1 baseline: Critical (9.0–10.0), High (7.0–8.9), Medium (4.0–6.9), Low (0.1–3.9), Informational (0.0).
• Reference bounty ranges (adjusted for impact/quality/duplication; higher end for exploitable, demonstrated impact; lower end for theoretical/limited impact):
  • Critical: USD 10,000–18,000 (e.g., RCE, payment-data SQLi, auth bypass, payment tampering, mass data breach, critical cloud/IAM takeover)
  • High: USD 4,000–10,000 (e.g., stored XSS on critical surfaces, internal SSRF with impact, payment IDOR, broken access control affecting sensitive data/flows)
  • Medium: USD 750–4,000 (e.g., CSRF password change, reflected XSS with realistic impact, subdomain takeover, business logic abuse with fraud potential)
  • Low: USD 100–750 or swag (low-impact technical issues with limited risk)
  • Informational: recognition only
• Out of scope/no bounty: scanner noise without proof, version disclosure only, SPF/DKIM/DMARC, clickjacking on static pages, non-sensitive cookie flags, self-XSS, third-party issues, purely theoretical attacks without PoC.
• Bonuses: first valid Critical (+25%), multi-step exploit chain (+50%), high-quality report with working exploit + remediation guidance (+10–25%).
• Severity may be adjusted using business context and exploitability; payouts in USD (FX at approval date if another currency is requested).

5) Rules of Engagement

• Prohibited: social engineering/phishing, user/employee deception, DoS/DDoS, spam, physical attacks.
• Avoid destabilizing scans (load tests/heavy fuzz) unless pre-approved in writing.
• Use only test accounts/synthetic data; do not access real customer/third-party data.
• No public disclosure until Tanqory fixes or authorizes (coordinated disclosure).
• Stop and report immediately if unintended data access occurs; minimize data viewed.
• Follow local law and Singapore Computer Misuse/Data Protection laws plus Safe Harbor conditions.
• Keep testing evidence secure; do not share beyond the report.
• Traffic caps (guidance): Production ≤5 rps (300 rpm); Staging/Test ≤10 rps (600 rpm); stop on 429 unless pre-approved.
• No mass fake accounts or bypassing anti-abuse controls.
• Do not use/sell vulnerabilities for other commercial gain before official fix.
• Where local law requires authorization for testing, obtain and retain proof.

6) Reporting

• Channel: security@tanqory.com with subject “[Bug Bounty]
  ” and/or https://security.tanqory.com/report.
• Include: contact info, target/domain, steps to reproduce, impact, proposed CVSS base score, PoC (screenshot/video/script), data accessed, constraints/assumptions.
• SLAs: acknowledge ≤24 business hours; status update ≤5 business days; initial assessment ≤10 business days (or notify if more time needed).
• Duplicates: first complete report prevails; later reports may receive recognition.
• Provide config/version/build and environment (OS/Browser/App) tested.
• Attach traffic logs only as needed; avoid unrelated personal data.
• For privacy/financial issues, note legal/compliance impact.
• Use urgent channel if exploit is active/widespread.

7) Evaluation & Payment

• Impact rating: CVSS + business context (payment/PII/control systems/continuity).
• Payment: bank transfer or PayPal; KYC/tax forms required (e.g., W-8BEN/W-9).
• Timing: within 15 business days after acceptance and agreement on severity/amount.
• No bounty if rules are violated, methods are illegal, or report is duplicate without added value.
• Bounty may be reduced if unnecessary availability impact occurred or “stop” requests were ignored.

8) Remediation & Disclosure

• Prioritize fixes by severity/impact; internal example SLA: Critical 7–14 business days, High 15–30 (complexity dependent).
• Deploy via Change/Release Management; may use hotfix/feature flag/rate limit for active abuse.
• Coordinated disclosure: default 90 days unless otherwise agreed; no public release before fix/approval.
• Tanqory may publish summary/CVE and credit researchers (with consent) after remediation.

9) Safe Harbor

• Tanqory will not pursue legal action against researchers acting in good faith within scope, avoiding harm, and following this policy.
• Safe Harbor does not override local laws requiring authorization; researchers must obtain such approvals.
• No extortion, sale, or weaponization of findings; doing so voids protection.
• If you overstep unintentionally, stop and report; intent and impact will be considered.

10) Privacy & Data Handling

• Do not access/copy/store real customer data; if encountered, stop, report, then delete/destroy.
• Secrets/keys/tokens seen must not be reused; disclose minimally.
• Tanqory processes researcher personal data only for program operation (validation, payment, audit) per our Privacy Policy/DPA where applicable.

11) Recognition

• Valid reports may be acknowledged on the Hall of Fame (with consent) and may receive swag/letters of recognition.
• Anonymity is available on request (“Anonymous Researcher”).
• Additional recognition case by case: LinkedIn endorsement, reference letter, invitations to security talks/private programs.

12) Policy Updates

• Scope/reward/rule changes will be posted on https://security.tanqory.com/bounty and emailed to registered researchers.
• Material changes will have reasonable notice unless urgent security needs apply.

13) References

• ISO/IEC 29147 (Vulnerability Disclosure)
• ISO/IEC 30111 (Vulnerability Handling)
• OWASP ASVS, OWASP Top 10, CWE, CVSS v3.1
• NIST SP 800-115 (Technical Guide to Information Security Testing)

14) Contacts

• Report: security@tanqory.com or https://security.tanqory.com/report
• Urgent: mark “[URGENT]” in subject; emergency contact posted on bounty portal.
• Scope questions: security@tanqory.com (“[Scope Inquiry]”)
• Legal/general: legal@tanqory.com

Appendix A: Payout, Tax, and Methods (Examples)

• Methods: bank transfer (SWIFT/IBAN), PayPal; Wise where supported; donation to approved charities with up to 50% matching (optional).
• Currency: USD primary; FX at approval date for other currencies.
• Fees: disclosed if deducted (e.g., PayPal processing).
• Tax:
  • Singapore: NRIC/FIN may be required for receipts.
  • United States: W-9 for US persons; 1099-MISC if thresholds apply.
  • Others: W-8BEN commonly required; local certificates on request.

Appendix B: Legal/Regulatory Notes

• Regulatory cooperation: we may need to report incidents to regulators (e.g., PDPC SG, GDPR authorities) and preserve evidence; we will distinguish good-faith researchers and provide program context.
• Export/sanctions: researchers/tools/cloud services must comply with US/EU/SG export/sanctions rules.
• Local testing laws: some jurisdictions (e.g., FR/CN) may require written authorization—retain proof where applicable.

Appendix C: Glossary (selected)

• CVSS: Common Vulnerability Scoring System.
• PoC: Proof of Concept.
• KYC: Know Your Customer.
• PII: Personally Identifiable Information.
• RCE/SSRF/IDOR: Remote Code Execution / Server-Side Request Forgery / Insecure Direct Object Reference.
• DoS/DDoS: Denial of Service/Distributed Denial of Service.
• Safe Harbor: Legal protection for good-faith testing within this policy.
• TTR/TTC: Time to Respond/Time to Close.

Appendix D: In/Out of Scope (Examples)

• In scope (illustrative; see live list on portal for updates):
  • Tier 1 (Critical user/data flows): api.tanqory.com, app.tanqory.com, checkout.tanqory.com, accounts.tanqory.com, auth.tanqory.com, admin.tanqory.com, mobile apps (iOS/Android), primary payment/auth flows.
  • Tier 2 (High-value business surfaces): dashboard.tanqory.com, partners.tanqory.com, integrations.tanqory.com, inventory.tanqory.com, reports.tanqory.com.
  • Tier 3 (Standard properties): www.tanqory.com, blog.tanqory.com, dev.tanqory.com, help.tanqory.com, status.tanqory.com.
• Out of scope (illustrative):
  • All third-party services (e.g., Cloudflare/AWS/Stripe), DoS/DDoS/load testing without approval, spam/credential stuffing.
  • Social engineering/phishing, physical intrusion, employee email/accounts, corporate IT (non-product) assets.
  • Purely theoretical findings without PoC, version disclosure only, scanner noise.
• Latest authoritative scope and constraints are maintained at https://security.tanqory.com/bounty.

Appendix E: Document Details